AD FS CVE-2026-85324

Requires a reachable AD FS (Active Directory Federation Services) role endpoint on an affected Windows Server build (e.g., Server 2016/2019/2022/2025 and Server Core variants prior to the listed patched builds); the AD FS role must be installed and network-accessible to the attacker. No authentication, privileges, or user interaction are needed (PR:N/UI:N), so default AD FS deployments exposed to the attacker's network are at risk. Limiting factors: organizations that do not run the AD FS role are unaffected, and exposure is reduced where AD FS endpoints are restricted to internal networks or fronted by a Web Application Proxy / filtering layer; impact is confined to availability (service disruption), with no data exposure or code execution.

All signals converge on this being a genuine but moderate-priority availability issue rather than a critical breach risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity, unauthenticated denial of service with impact strictly on availability - there is no confidentiality or integrity loss, which caps the score at 7.5/HIGH. This is corroborated by CWE-789 (memory allocation with excessive size) and the description, both of which point to a resource-exhaustion DoS, not code execution or data compromise. SSVC reinforces a measured posture: Exploitation is 'none' (no observed or public exploitation), Automatable is 'yes' (consistent with a scriptable unauthenticated network request), and Technical Impact is 'partial' (service disruption, not full control). There is no CISA KEV listing and no POC identified, and no EPSS score was supplied in the input, so exploitation probability cannot be quantified from this data. Note the conflict to flag: the input Tag 'Authentication Bypass' directly contradicts the CVSS impact metrics (C:N/I:N/A:H) and the description - this is a pure availability DoS, not an auth bypass, so that tag should be disregarded. Net: a real patch-worthy issue for AD FS operators given the unauthenticated network vector, but lower urgency than any flaw carrying confidentiality/integrity impact or active exploitation.

A remote, unauthenticated attacker sends a specially crafted request to an internet- or network-reachable AD FS endpoint that causes the service to allocate an excessively large amount of memory, exhausting resources and crashing or hanging the federation service. Because AD FS brokers single sign-on, a successful DoS can block authentication for all federated applications until the service recovers. No public exploit identified at time of analysis, and SSVC lists exploitation as 'none'.