AD FS CVE-2026-72978

Requires network reachability to an AD FS (Active Directory Federation Services) endpoint on an affected Windows Server build (Server 2012 through 2025, including Server Core, plus Windows 10 1607/1809 hosting the role). Per the CVSS vector this is remote and unauthenticated with low complexity and no user interaction (AV:N/AC:L/PR:N/UI:N), so default AD FS deployments that are internet- or intranet-reachable are exposed. Limiting factors: the target must actually run the AD FS role (a specific, optionally-installed federation service, not every Windows Server), the endpoint must be reachable by the attacker, and CISA's SSVC assessment rates the flaw as Automatable=no, suggesting exploitation is not trivially scriptable for mass campaigns. Impact is confined to availability (C:N/I:N/A:H) - a service outage, not data compromise or code execution.

Signals are internally consistent and point to a genuine but moderate-priority availability issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated resource-exhaustion flaw with pure availability impact and no confidentiality or integrity loss - a classic CWE-770 DoS. Corroborating signals temper the urgency: EPSS is low at 0.80% (54th percentile), CISA SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial, and there is no KEV listing and no public exploit. The 'Automatable: no' SSVC value is notable because it means CISA does not currently assess this as trivially scriptable at scale despite the AC:L/PR:N vector, which slightly lowers the practical mass-exploitation risk. Microsoft has shipped a patch. Net: this is a real, remotely triggerable DoS against an internet-facing identity component and should be patched on exposed AD FS servers, but it is not a high-CVSS-but-illusory issue nor an actively exploited emergency - it is a standard Patch-Tuesday-tier availability fix. No signals conflict; the main limitation is that the vendor description is terse and does not name the specific request type or resource that is exhausted.

An attacker with network reach to an organization's AD FS endpoint (often internet-facing to support federated logon) sends a stream of specially crafted or high-volume requests that cause AD FS to allocate resources without limit or throttling, exhausting memory/CPU/handles until the service stops responding. No authentication or user interaction is required, so any party able to reach the endpoint can attempt it. No public exploit code has been identified at time of analysis.