What is the CVSS score of CVE-2026-50647?

CVE-2026-50647 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.1%.

Which versions of AD FS are affected by CVE-2026-50647?

Microsoft Active Directory Federation Services (AD FS) contains a network-accessible denial-of-service vulnerability allowing unauthenticated attackers to disable single sign-on across your entire…. A patch is available.

How to fix or mitigate CVE-2026-50647?

Within 24 hours, identify all Windows Server instances hosting the AD FS role and determine their current patch status; establish a maintenance window and service recovery procedure. Within 7 days, apply the vendor-released patch (available per Microsoft security advisory for AD FS) to all production AD FS servers, testing the update in a non-production environment first and validating SSO connectivity to relying-party applications. Within 30 days, confirm 100% deployment of the patch across all AD FS infrastructure and execute end-to-end testing of single sign-on functionality.

AD FS CVE-2026-50647

EUVD-2026-44118 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-07-14 microsoft

GHSA-wcpq-cwvv-7pj4

Denial Of Service Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable AD FS endpoint, no auth or interaction, low-complexity infinite-loop trigger; availability-only impact with no confidentiality or integrity loss and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:50 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.5

DescriptionCVE.org

Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial of service in Microsoft Active Directory Federation Services (AD FS) allows an unauthenticated, remote attacker to send crafted network requests that drive a request-handling routine into an infinite loop (CWE-835), exhausting CPU and rendering the federation service unavailable. All supported Windows Server releases hosting the AD FS role are impacted, and because the flaw requires no authentication and no user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), it can knock out single sign-on for every relying-party application. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority availability issue rather than a confirmed active-exploitation event.

Technical ContextAI

AD FS is Microsoft's on-premises identity federation and single sign-on (SSO) service that issues security tokens (SAML/WS-Federation/OAuth) so users authenticate once and reach multiple relying-party web applications. The root cause is CWE-835, 'Loop with Unreachable Exit Condition (Infinite Loop)': a code path processing attacker-influenced input enters a loop whose termination condition is never satisfied, so a worker thread spins indefinitely and consumes CPU. In a network-facing token/federation endpoint this ties up request-processing threads and starves the service. The Microsoft CPE data attributes the flaw to the underlying Windows component set spanning Windows Server 2012 through Windows Server 2025 (and the corresponding Windows 10/11 client builds that share the component), meaning the vulnerable code ships broadly across the supported Windows platform where the AD FS role can run.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50647 to every affected Windows Server (and, where the shared component is present, client) build via the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50647, which lists the exact fixed build number for each product - install the update on all AD FS servers in the farm and reboot as required. Exact fix version numbers are not reproduced in the input data, so pull them directly from the MSRC update guide rather than relying on an inferred version. As compensating controls until patching completes, restrict network reachability of AD FS endpoints by placing them behind the Web Application Proxy or a reverse proxy and limiting source IPs to expected federation partners, rate-limit or filter anomalous requests to the AD FS token endpoints at the load balancer or WAF, and monitor AD FS worker-process CPU so a spinning thread can be caught and the service recycled; note these controls reduce exposure and buy detection time but do not remove the vulnerable code path, and aggressive source-IP restriction can break legitimate external SSO for remote users or partner organizations.