AD FS CVE-2026-50684

Exploitation requires the attacker to already hold high-privileged (administrative) authorization on the AD FS system - confirmed by CVSS PR:H and the Microsoft description's 'authorized attacker' language. Victim user interaction is mandatory: a legitimate AD FS user must browse to and interact with the injected page (CVSS UI:R). AD FS must be deployed and accessible over the network for the spoofing to reach victims. Limiting factors include: the attacker must have pre-existing administrative control of the AD FS server (making this a post-compromise pivot rather than an initial access vector), at least one victim user must visit the affected portal page, and the attack is not automatable per SSVC. There is no requirement for a non-default AD FS configuration - any standard AD FS deployment on the affected OS versions is in scope once the admin-level prerequisite is met.

Multiple signals converge on a low real-world risk rating. CVSS base score of 4.8 (Medium) is appropriately calibrated given PR:H and UI:R - both of which represent hard prerequisites that prevent opportunistic or automated exploitation. SSVC independently corroborates this: exploitation status 'none', automatable 'no', technical impact 'partial'. EPSS at 0.38% (30th percentile) reflects the broader security community's low confidence that this will see active exploitation in the near term. The vulnerability is not listed in CISA KEV. The spoofing classification means the realistic worst-case outcome is UI deception or session token theft within the browser, not remote code execution or privilege escalation. The primary threat model is an insider or a threat actor who has already achieved admin-level access to the AD FS system and uses this XSS as a lateral movement or phishing amplification technique against federated users. There is no conflicting signal between the CVSS vector and the description - both indicate network-delivered, high-privilege, user-interaction-dependent impact.

An attacker who has compromised an AD FS administrator account (or a malicious insider with delegated AD FS administration rights) injects a JavaScript payload into an AD FS configuration element - such as a relying party display name or custom claims rule - that is subsequently rendered unsanitized in the AD FS sign-in portal. When a federated user navigates to the AD FS authentication page, the script executes in their browser, spoofing login UI elements or exfiltrating the session token to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis.