AD FS CVE-2026-83646

Exploitation targets the AD FS federation web endpoints on affected Windows Server builds (Server 2016 <10.0.14393.9612, Server 2019 <10.0.17763.9376, Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650, and Windows 10 1607/1809) that have the AD FS role configured and internet- or user-reachable. Per the CVSS vector, exploitation is limited by two concrete factors: the attacker must hold high privileges (PR:H, an authorized AD FS actor) and a victim must actively interact by clicking the crafted redirect URL (UI:R). The impact is confined to spoofing/redirection (C:L/I:L, A:N) rather than direct compromise of the AD FS server. Organizations not running the AD FS role, or that have applied the listed fixed builds, are not exposed.

This is a moderate-severity (CVSS 4.8) open redirect in Active Directory Federation Services, and the aggregated signals point to a low real-world priority rather than an urgent one. The provided CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) already constrains risk heavily: exploitation requires high privileges (PR:H), mandatory victim interaction (UI:R), and yields only low confidentiality/integrity impact with no availability impact - consistent with a spoofing/phishing primitive rather than code execution or data theft. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input; per the precision rules this is treated as 'no public exploit identified at time of analysis,' and absence of these signals is not itself evidence of safety but does argue against widespread automated exploitation. There is a notable internal tension worth flagging to defenders: Microsoft's own vector sets PR:H (implying the attacker must already be a highly privileged federation user), yet classic open-redirect/spoofing attacks typically need little to no privilege because the attacker merely crafts a malicious URL for a victim to click - verify the true privilege prerequisite with Microsoft's MSRC advisory before deprioritizing. Net: a genuine but low-urgency issue best handled in normal patch cycles, elevated only because AD FS sits on the authentication path.

An attacker crafts a malicious AD FS URL that appears to originate from the organization's trusted federation endpoint but redirects the victim to an attacker-controlled site after authentication flow interaction. A user who clicks the link (UI:R) is silently sent to a spoofed page used for credential harvesting or further phishing. No public exploit code was identified at time of analysis.