AD FS CVE-2026-50647

The only hard prerequisite is network reachability of an AD FS service endpoint; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no privileges, and no user interaction required, so any actor able to send requests to the AD FS token/federation endpoint can attempt the attack against a default AD FS deployment. What limits exploitation in practice is deployment posture rather than the flaw itself: the target host must actually have the AD FS role installed and its endpoints must be reachable from the attacker's network position (internet-facing AD FS or a Web Application Proxy dramatically widens exposure, whereas internal-only AD FS behind segmentation narrows it). Impact is confined to availability (C:N/I:N/A:H) - no data disclosure or code execution - and the scope is unchanged (S:U), so a successful hit degrades the AD FS service and the SSO it provides rather than pivoting to other systems.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent for a pure availability attack: network reachable, low complexity, no privileges, no user interaction, high availability impact, and no confidentiality or integrity loss. That combination makes exploitation trivial once a working trigger is known, but the practical blast radius depends on AD FS being network- or internet-exposed, which is common for federation though often fronted by a Web Application Proxy. Countering the low-complexity signal, there is no public exploit identified at time of analysis, no POC, and no CISA KEV listing, so real-world exploitation is currently unproven; no EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. This is a genuine priority for organizations whose SSO availability is business-critical (an AD FS outage cascades to every relying-party app), but it is a DoS-only issue with no data-compromise path - patch on a normal-to-expedited cycle rather than treating it as an emergency compromise event.

An unauthenticated attacker who can reach an AD FS endpoint over the network (directly or through an exposed Web Application Proxy) sends a specially crafted request that trips the flawed processing loop, pinning a worker thread at 100% CPU. Repeating this a handful of times exhausts the service's thread pool, causing token issuance to hang and taking down single sign-on for all dependent applications. No exploit code is publicly identified at time of analysis, but the low attack complexity (AC:L) and absence of any authentication or user-interaction requirement make a reliable trigger straightforward to weaponize once the input condition is discovered.