AD FS CVE-2026-50324

The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H indicates the AD FS service must be network-reachable from the attacker (standard for internet or intranet-facing AD FS deployments), and no authentication is required. However, the High Attack Complexity (AC:H) is the primary limiting factor: exploitation is not straightforward or automatable (confirmed by SSVC Automatable=no) and requires the attacker to satisfy specific conditions - likely a precisely structured request that exercises the unreachable loop exit path. The CVE description does not name a specific configuration flag or feature that must be enabled beyond AD FS being deployed and operational in its default role. Exploitation is limited to those environments where the AD FS service role is installed and reachable; organizations that have not deployed AD FS are not affected. User interaction is not required.

The CVSS base score of 5.9 (Medium) is driven primarily by AC:H, which significantly limits opportunistic exploitation - the attacker must meet specific, non-trivial preconditions to successfully trigger the loop. The availability impact is rated High (A:H), meaning successful exploitation fully disrupts the AD FS service, which is a high-value target in enterprise environments as its failure blocks federated authentication. The EPSS score of 0.80% at the 52nd percentile indicates a below-average probability of active exploitation relative to all CVEs, consistent with the AC:H complexity barrier. SSVC assessment reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial - suggesting defenders should treat this as a scheduled patch rather than an emergency response. There is no CISA KEV listing and no public exploit code has been identified. The principal real-world risk is to organizations with internet-facing AD FS deployments where an attacker can craft and sustain the requisite high-complexity request, potentially blocking SSO for all federated users.

An attacker with knowledge of the specific request structure required by the AC:H condition sends a crafted network request to an exposed AD FS endpoint, causing the service's internal processing loop to enter an unreachable exit state. The AD FS worker process spins, consuming CPU and failing to service legitimate authentication requests, effectively blocking SSO for all federated users until the service is restarted or the patch is applied. No public exploit code exists at time of analysis, so this scenario currently requires attacker research investment to recreate the triggering condition.