Microsoft AD FS CVE-2026-83511

Requires a deployed AD FS (Active Directory Federation Services) role acting as a federation/identity provider and a network path to its authentication endpoints; exploitation targets the weak authentication logic to spoof a federated identity. The key LIMITING factor is CVSS AC:H: the attacker must satisfy conditions outside their control (such as a specific token-validation state or timing/race condition), which is why CISA SSVC rates the flaw as not Automatable and no exploitation observed. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the High attack complexity substantially reduces the realistic likelihood of reliable, repeatable exploitation compared to a low-complexity bug. Organizations not running the AD FS role are not exposed.

This is a moderate-severity (CVSS 7.4) spoofing flaw in AD FS stemming from weak authentication (CWE-1390). The signals are mixed and point toward a NON-urgent but genuine risk. On the elevating side: the CVSS vector is network-reachable with no privileges and no user interaction (AV:N/PR:N/UI:N), the stated confidentiality and integrity impact is high (C:H/I:H), and CISA's SSVC rates Technical Impact as 'total'. On the de-escalating side: CVSS attack complexity is High (AC:H), indicating the attacker must satisfy conditions outside their control, and SSVC rates Exploitation as 'none' and Automatable as 'no' - meaning no observed exploitation and no reliable mass-exploitation path. There is NO CISA KEV listing, NO public POC in the provided data, and NO EPSS score was supplied, so exploitation probability cannot be quantified. Net: treat as a real but not emergency priority - patch on a normal-to-expedited cycle rather than as an actively-exploited zero-day. Note one caveat: the description characterizes the outcome as 'spoofing' while the CVSS encodes C:H/I:H/A:N, a combination more typical of token/identity impersonation than data theft - verify the precise impact against the Microsoft advisory before finalizing internal severity.

A remote, unauthenticated attacker on a network path to an AD FS endpoint exploits the weak authentication to forge or impersonate a federated identity/security token, then authenticates to relying-party applications as another user. Because attack complexity is High (AC:H), success depends on conditions outside the attacker's direct control (e.g., winning a timing/validation condition or a specific token-handling state). No public exploit code was identified in the provided intelligence.