EUVD-2026-43887
GHSA-594h-q75v-4prq
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable AD FS with no auth required (PR:N), but AC:H reflects the non-trivial request crafting needed; no confidentiality or integrity impact, only availability.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
AnalysisAI
Active Directory Federation Services (AD FS) on multiple Windows Server and Windows 10 platforms contains an infinite loop flaw (CWE-835) that a remote unauthenticated attacker can trigger to exhaust service resources and cause a sustained denial of service. The attack requires high complexity (CVSS AC:H) but no authentication, targeting organizations that expose AD FS endpoints to the network. No public exploit code exists and CISA SSVC confirms no known exploitation at time of analysis; Microsoft has released patches across all affected platforms.
Technical ContextAI
CWE-835 (Loop with Unreachable Exit Condition) describes a code path in which a termination condition can never be satisfied, causing the process to spin indefinitely and consume CPU or memory until it becomes unresponsive or is killed. In AD FS - Microsoft's claims-based identity federation service used for SSO across organizational and cloud boundaries - this loop exists in network-accessible request-handling logic. The affected CPE strings span the Microsoft Windows Server family from Windows Server 2012 R2 (build 6.3.9600.x) through Windows Server 2025 (build 10.0.26100.x), as well as Windows 10 versions 1607 and 1809 that ship the AD FS role. The CVSS AV:N vector confirms the vulnerable code is reachable without local access, consistent with AD FS operating as a network-facing authentication endpoint.
RemediationAI
Apply the Microsoft-released security update for the applicable Windows Server or Windows 10 build. Target fix versions confirmed by EUVD are: Windows Server 2025 / Server Core - 10.0.26100.33158 or later; Windows Server 2022 - 10.0.20348.5386 or later; Windows Server 2019 / Server Core and Windows 10 1809 - 10.0.17763.9020 or later; Windows Server 2016 / Server Core and Windows 10 1607 - 10.0.14393.9339 or later; Windows Server 2012 R2 / Server Core - 6.3.9600.23291 or later. The canonical Microsoft patch guidance is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50324. As a compensating control where immediate patching is not possible, network-layer restrictions that limit which source IPs can reach AD FS endpoints (via perimeter firewall or Windows Firewall rules) reduce the attack surface, at the cost of restricting legitimate federated authentication from those sources. Additionally, deploying AD FS behind a Web Application Proxy or reverse proxy with request rate limiting and anomaly detection can help absorb or detect the high-complexity crafted requests needed to trigger the loop.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today