Microsoft AD FS CVE-2026-85321

Exploitation requires the AD FS role to be installed and its endpoints reachable over the network by the attacker - typically true where AD FS is published to the internet or an untrusted segment to support federated/single sign-on. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no special privileges, and no user interaction are needed against a default-configured AD FS service; the limiting factor is network exposure of the AD FS listener. Affected builds include Windows Server 2012 R2, 2016, 2019, 2022, and 2025 below the patched build numbers (e.g., 2025 <10.0.26100.33650, 2019 <10.0.17763.9376); fully patched systems and deployments where AD FS is not reachable by untrusted clients are not exploitable. Impact is limited to availability (service outage); no confidentiality or integrity loss occurs.

Signals are largely consistent and point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which justifies the 7.5 (HIGH) score driven entirely by availability impact (A:H, C:N/I:N) - this is a pure denial-of-service issue, not a code-execution or data-disclosure threat. CISA's SSVC framework reinforces a measured priority: Exploitation is rated 'none' (no observed or public exploitation), but Automatable is 'yes' (resource-exhaustion flood attacks scale trivially) and Technical Impact is 'partial'. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. There is no KEV listing and no public exploit identified, so despite the attractive unauthenticated-network profile this is not currently an emergency. The main contrast is CVSS/SSVC-Automatable (easy, scalable) versus SSVC-Exploitation 'none' and absent POC/KEV - meaning the vulnerability is theoretically easy to weaponize but not yet observed being used. Because AD FS is an internet-facing authentication front-end for many organizations, a successful DoS would block federated sign-in for all dependent applications, so this should be patched on a prompt but non-panic timeline.

An unauthenticated attacker with network access to an exposed AD FS endpoint sends a stream of specially crafted requests that cause the service to allocate resources without throttling, exhausting memory or connection capacity. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N and SSVC marks the attack Automatable, the flood can be scripted and scaled to keep the service down, blocking single sign-on for all relying applications. No public proof-of-concept or exploit code has been identified at time of analysis.