Microsoft AD FS CVE-2026-69982

Requires network reachability to the target's AD FS service (the federation/SSO endpoint); no credentials and no user interaction are needed (PR:N/UI:N), making default-configured, internet-exposed AD FS deployments the primary exposure. The key limiting factor is the CVSS High attack complexity: the description and CWE-1390 (weak authentication) imply the bypass succeeds only under specific, attacker-uncontrolled conditions (such as particular token/request state or timing), not against every request. The precise feature and precondition are not specified in the available data, so defenders should treat externally reachable AD FS instances on pre-patch builds (e.g., Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761, Server 2019 <10.0.17763.9376) as the exposed surface.

This is a moderate-severity (CVSS 5.9) authentication-bypass weakness (CWE-1390) in Microsoft AD FS. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N tells a mixed story: the flaw is network-reachable and requires no privileges or user interaction (favoring attackers), but carries High attack complexity, meaning successful exploitation depends on conditions outside the attacker's control (e.g., winning a race, specific token/state, or a non-trivial precondition) - which materially lowers real-world likelihood versus an AC:L bug. Impact is scoped to Integrity only (C:N/I:H/A:N): the attacker bypasses a security feature but does not directly read data or deny service. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is currently no evidence of active exploitation or weaponized exploit code; combined with AC:H, this reads as a genuine but not emergency priority - patch on normal cadence, prioritizing internet-exposed federation endpoints. Note the signals are not conflicting so much as sparse: exploitability metrics are confirmed by the CVSS vector, but exploitation-in-the-wild telemetry (EPSS/KEV/POC) is simply absent rather than negative, so 'low real risk' is inferred from AC:H and missing exploitation signals, not independently confirmed.

An attacker who can reach an organization's AD FS endpoint over the network crafts requests that exploit the weak authentication logic to bypass a security control, under the specific conditions implied by the High attack complexity (e.g., particular timing or token state). No valid credentials and no user interaction are required (PR:N/UI:N). No public exploit code was identified at time of analysis.