Microsoft AD FS spoofing vulnerability lets unauthenticated attackers spoof identities over the network (CVE-2026-96252)

What happened

Microsoft's October 2026 security update addresses CVE-2026-96252, an improper verification of cryptographic signatures in Active Directory Federation Services (AD FS). The vulnerability is reachable over the network, requires no privileges and no user interaction. An attacker who can reach an AD FS endpoint may be able to present a forged signature that the service accepts, enabling identity spoofing in a federated authentication exchange.

The CVSS 3.1 base score is 9.1 (Critical); Microsoft's advisory rates it Important. Confidentiality and integrity impact are rated high; availability is not affected. The SSVC assessment rates exploitation as automatable and technical impact as total. Microsoft has not stated that this vulnerability is being exploited, and no public disclosure is recorded.

Who is affected

Affected products are Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022 and Windows Server 2025, including Server Core installations, at versions before the fixed builds listed below. AD FS is a federation service; review which of your AD FS endpoints are reachable from the internet or partner networks.

What to do now

1. Apply Microsoft's October 2026 security update. Fixed builds (Server Core installations share the same fixed builds):

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 (KB5126868)
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9376 (KB5126651)
• Windows Server 2012: 6.2.9200.26434 (KB5126835)
• Windows Server 2012 R2: 6.3.9600.23470 (KB5126836)
• Windows Server 2022: 10.0.20348.5761 (KB5126655)
• Windows Server 2025: 10.0.26100.33650 (KB5126646)

1. Microsoft has not published a workaround, so patching is the primary remediation.
2. If you cannot patch immediately, restrict network access to AD FS endpoints to trusted networks and identity providers, and monitor federation server authentication events.

How to detect it

Microsoft has not published indicators of compromise. Identify AD FS endpoints that are reachable from untrusted networks, because this vulnerability is exploitable over the network without credentials, and review federation server authentication logs for anomalies.

Beyond the patch

Beyond the update, treat AD FS as a network-reachable identity service: this flaw needs no credentials and no user interaction, so exposed federation endpoints are the main risk. Virtual CISO Services can help you map and reduce that exposure, and Managed Detection & Response watches identity and authentication paths for spoofing activity. Apply the patch first, then verify that only required identity providers and networks can reach your federation servers.