Active Directory Federation Services CVE-2026-50695

Exploitation requires network reachability to a running AD FS service endpoint; the attacker needs no authentication, no privileges, and no user interaction (AV:N/PR:N/UI:N/AC:L), so any host able to reach the AD FS or Web Application Proxy listener can attempt it against default configurations. The principal limiting factor is exposure and role deployment: only servers with the AD FS role installed and reachable are at risk, so environments that keep AD FS strictly internal or behind restrictive Web Application Proxy filtering substantially narrow the attack surface. The impact is limited to denial of service (A:H, C:N/I:N) - a service crash - not data theft or code execution.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes an attractive, low-friction DoS: reachable over the network, low attack complexity, no privileges, and no user interaction - but the impact is strictly availability, with no confidentiality or integrity loss. There is no EPSS score, KEV entry, or POC in the supplied data, so real-world exploitation pressure is presently unquantified; the signals we do have suggest a genuine but non-critical priority. The key mitigating factor is exposure: AD FS is normally deployed behind a Web Application Proxy and typically internet-facing only for federated login, so the blast radius depends heavily on whether the AD FS endpoint is externally reachable. This is a legitimate patch-soon item for identity infrastructure rather than an emergency, given the absence of code execution and of any evidence of active exploitation.

A remote attacker with no credentials sends a crafted request to an internet-reachable AD FS endpoint, overflowing a fixed-size stack buffer and crashing the service. With AD FS down, users and applications relying on it for single sign-on can no longer authenticate, producing an outage across all federated services. No public proof-of-concept is identified at time of analysis, and low attack complexity means a working exploit, if developed, would be simple to fire repeatedly.