AD FS EUVD-2026-100308

Requires network reachability to an Active Directory Federation Services (AD FS) endpoint; AD FS must be deployed and exposed (internet-facing federation proxies are the highest-risk deployment). Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. Limiting factors: the target must actually run the AD FS role (an optional Windows Server component, increasingly replaced by Entra ID), and because the weakness is an observable discrepancy (CWE-203), successful disclosure likely depends on the attacker being able to send repeated requests and measure response differences - practical exploitation may be more involved than the AC:L rating suggests, and the value of leaked data depends on configuration.

This is a moderate-priority information-disclosure flaw rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N), and SSVC-style reasoning would place technical impact at 'partial' (read-only disclosure, no code execution). Exploitation status is 'no public exploit identified at time of analysis' - the CVE is not listed in CISA KEV and no POC is referenced, and no EPSS score was supplied, so the probability of near-term mass exploitation cannot be quantified from the input. A key tension exists between the vector and the weakness type: CWE-203 (Observable Discrepancy) typically denotes a side-channel/oracle (e.g. timing or response-differential) condition, which in practice is often higher-complexity and attacker-dependent than the vendor's AC:L rating implies; the real-world value of the disclosed data (tokens, account/claim details, or federation metadata) is not specified and should be verified with Microsoft's advisory. Net: a legitimate patch-soon item for AD FS operators, especially internet-facing federation endpoints, but not a drop-everything issue absent evidence of active exploitation.

An unauthenticated attacker who can reach an AD FS federation endpoint over the network sends crafted authentication or token requests and observes discrepancies in the responses (CWE-203 observable differences such as timing or error variation). By comparing these responses, the attacker infers sensitive information such as valid account states or token/claim data without needing any credentials. No public exploit code is referenced for this CVE.