AD FS CVE-2026-70005

Exploitation targets the AD FS role on Windows Server (2019 builds <10.0.17763.9376, 2022 <10.0.20348.5761, 2025 <10.0.26100.33650, including Server Core installations); the attacker must have network reachability to the AD FS federation endpoint, which in many deployments is internet-facing. No authentication is required (PR:N) and no user interaction (UI:N), but the HIGH attack complexity (AC:H) is the key LIMITING factor: the attacker must meet conditions outside their control - plausibly specific token/claim handling, timing, or server state during the weak authentication check - which the vendor description does not fully specify. Organizations not running the AD FS role, or already patched to the fixed builds, are not exposed.

This is a moderate-severity security feature bypass in Active Directory Federation Services (CVSS 5.9, CWE-1390 Weak Authentication). The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N indicates network-reachable, unauthenticated exploitation (PR:N) but with HIGH attack complexity (AC:H), meaning success depends on conditions outside the attacker's direct control - likely timing, specific token/claim handling, or a race or configuration-dependent state. Impact is scoped to integrity only (I:H, C:N/A:N), consistent with bypassing an authentication/security control rather than directly stealing data or causing outage. No EPSS score was provided in the input, there is no CISA KEV listing, and no public POC is indicated - exploitation status is therefore 'no public exploit identified at time of analysis.' The high complexity meaningfully tempers the otherwise-attractive unauthenticated-network profile, so this is a real-but-not-urgent patching priority rather than a drop-everything issue. Note the signal gap: EPSS probability is absent from the input and cannot be weighed, so prioritization should lean on the AC:H constraint and the fact that AD FS is an internet-facing identity broker in many environments.

A remote, unauthenticated attacker who can reach an organization's AD FS endpoint crafts a request that abuses the weak authentication check to bypass an intended security control, gaining improperly validated authentication state. Because AD FS brokers single sign-on to downstream applications, a successful bypass could let the attacker assume a trust context they should not hold. The HIGH attack complexity means the attacker must satisfy specific conditions (e.g., precise request/token manipulation or a particular server state), and no public exploit code is known at time of analysis.