Active Directory Federation Services EUVD-2026-43906

Exploitation requires network reachability to a running AD FS server's federation endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and low attack complexity, so against a reachable AD FS instance no special conditions apply beyond the AD FS role being installed and accepting network requests. The practical limiting factor is exposure scope: AD FS exists only where an organization has deployed on-premises federation/SSO, and internet reachability typically depends on whether a Web Application Proxy publishes the endpoints externally versus keeping them internal-only. Impact is limited to availability (C:N/I:N/A:H) - the attacker can crash the service but cannot read tokens, forge authentication, or execute code - so the condition that matters for defenders is a network path to the AD FS listener, not any credential or configuration prerequisite.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction whose sole consequence is high availability impact - a pure denial of service with no confidentiality or integrity loss. This is a genuine operational concern rather than a data-breach risk: knocking out AD FS breaks SSO for every relying-party application that depends on it, effectively locking users out of federated services until the service recovers. However, EPSS data was not provided, the CVE is not in CISA KEV, and no proof-of-concept is referenced, so there is no evidence of active or imminent exploitation. Weighing these signals together, this is a meaningful availability risk for identity infrastructure but not a code-execution or lateral-movement threat; prioritize patching on internet-facing AD FS/Web Application Proxy deployments while treating purely internal instances as important-but-not-emergency. Note the SSVC fields (exploitation status, automatable, technical impact) were not supplied, so automatability cannot be independently confirmed.

An attacker with network access to the AD FS service - for example through an internet-exposed Web Application Proxy or from an internal foothold - sends a specially crafted request to the vulnerable AD FS endpoint that overflows a stack buffer during parsing, crashing the service. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), the attacker can repeatedly trigger the fault to keep federated SSO offline. No public proof-of-concept is identified at time of analysis.