Microsoft ADFS CVE-2026-50368

Exploitation requires that the target host has the Active Directory Federation Services role installed and that its federation endpoint is reachable by the attacker over the network (AV:N); per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required, so any network-reachable ADFS listener can be targeted against default configurations. The primary limiting factor is exposure - organizations that keep ADFS internal-only or behind Web Application Proxy with strict access controls sharply reduce who can reach the vulnerable parser, and hosts without the ADFS role are unaffected. Realistic risk is highest where ADFS is published to the internet for external partner SSO.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a low-complexity, unauthenticated, network-reachable attack with high availability impact but no confidentiality or integrity impact - a pure denial of service, not remote code execution, which is why the score caps at 7.5 rather than critical. No EPSS score, KEV entry, or POC is present in the provided data, so real-world exploitation pressure appears low today and the signals are internally consistent (network DoS, patch available) with no conflicts. Practical priority is elevated for organizations that expose ADFS to the internet for external federation, since a single crafted request can take down the SSO service that gates many downstream applications, but this is a targeted availability risk rather than a data-breach or worm-class issue. Note that while CWE-121 stack overflows can sometimes enable code execution, the vendor-assigned impact here is availability-only (C:N/I:N) - treat any RCE possibility as unconfirmed unless Microsoft states otherwise.

An attacker who can reach an internet- or DMZ-exposed ADFS federation endpoint sends a single crafted request whose oversized field overflows a stack buffer in the ADFS request parser, terminating the service and dropping single sign-on for all relying-party applications until it restarts. The attacker can repeat the request to sustain the outage. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication (PR:N) mean such an exploit would be straightforward to weaponize if developed.