AD FS CVE-2026-50411

The attacker needs network access to a reachable AD FS endpoint (typically the AD FS server or an externally published Web Application Proxy) on a Windows host running the AD FS role. Per the CVSS vector this requires no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L), so an unauthenticated remote attacker can trigger it against a standard AD FS deployment. What limits exploitation: AD FS must actually be installed and its endpoint must be routable to the attacker - instances exposed only to internal/trusted networks are not remotely triggerable from the internet, and the confirmed impact is limited to denial of service (A:H) with no code execution or data access, so successful exploitation degrades availability only.

The signals are internally consistent but modest. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, which is why the base score reaches 7.5 - but C:N/I:N/A:H means the sole impact is denial of service, with no data disclosure or code execution claimed. This is not a KEV entry (not confirmed actively exploited) and no POC is referenced, so real-world urgency is lower than the 7.5 alone suggests. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. No SSVC decision data was provided. The practical priority driver is exposure and criticality rather than raw severity: an internet-facing AD FS proxy that authenticates a large user base warrants prompt patching because a single crash denies SSO to all downstream apps, whereas an AD FS instance reachable only from an internal segment is materially lower risk. Note that a stack overflow is sometimes a precursor to code execution; the vendor characterizes this specific issue as availability-only (A:H, C:N, I:N), and that classification should be trusted unless Microsoft revises it.

An attacker who can reach the AD FS or Web Application Proxy endpoint over the network sends a specially crafted request whose oversized field overflows a stack buffer in the AD FS request-handling code, crashing the service without any credentials or user interaction. Repeated requests keep the federation service down, denying single sign-on to all dependent Microsoft 365 and web applications. No public exploit code is identified at time of analysis, but the low attack complexity and lack of authentication make weaponization straightforward if a POC emerges.