AD FS EUVD-2026-100450

Exploitation requires network reachability to an AD FS service endpoint (the federation/SSO role on an affected Windows Server, or the AD FS proxy/Web Application Proxy if published externally); per AV:N/AC:L/PR:N/UI:N no authentication, special privileges, or user interaction are needed against the service as shipped. The practical limiting factors are therefore exposure-based rather than configuration-based: the target environment must actually run the AD FS role (not every Windows Server does), the endpoint must be reachable by the attacker, and the host must be below the fixed build for its version (e.g. Windows Server 2025 <10.0.26100.33650, Server 2019 <10.0.17763.9376, Server 2016 <10.0.14393.9612, Server 2012 R2 <6.3.9600.23470). Organizations that do not deploy AD FS, or that have already applied the listed patch builds, are not exploitable.

This is a genuine, deploy-the-patch-now priority rather than a high-CVSS-but-low-impact issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exploitability profile: network-reachable, low attack complexity, no privileges, and no user interaction - meaning a remote, unauthenticated attacker can attempt it against an exposed AD FS endpoint with no preconditions. The impact is scoped tightly to integrity (C:N/I:H/A:N): consistent with a spoofing/authentication-bypass flaw (CWE-290) where an attacker can impersonate identity or forge trusted assertions without reading data or affecting availability. AD FS is a federation/SSO trust broker, so an integrity break there is high-leverage - forged tokens can grant access to downstream relying-party applications. Countervailing signals: this appears to be a freshly disclosed Microsoft-reported vulnerability with a patch already available, and there is NO EPSS score, NO CISA KEV listing, and NO public POC provided in the input, so there is no evidence of active or imminent mass exploitation yet. The low-complexity unauthenticated profile means exploitation probability could rise quickly once technical details or tooling emerge, but as of this analysis exploitation is unproven. EPSS is absent (not low - missing), so it cannot be weighed; absence of EPSS/KEV/POC should not be read as 'safe,' only as 'no exploitation signal observed yet.'

A remote, unauthenticated attacker reaches an internet- or network-exposed AD FS endpoint and sends crafted requests that exploit the spoofing weakness to forge or manipulate an identity assertion/token that AD FS or a relying party will trust. Because no credentials or user interaction are required (PR:N/UI:N) and attack complexity is low, the attacker can impersonate a legitimate principal and gain access to federated applications. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector and CWE-290 spoofing classification.