Active Directory Federation Services EUVD-2026-43995

Exploitation requires network reachability to a running AD FS service endpoint (typically the federation/token-issuance or metadata endpoints, often exposed externally via the Web Application Proxy); the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction and low complexity against a reachable AD FS instance. The principal limiting factor is deployment exposure: only hosts with the AD FS role installed and network-accessible are at risk, so internal-only or firewall-restricted AD FS deployments materially reduce the attack surface, and organizations not using AD FS are unaffected. Impact is confined to availability (service crash/DoS) - there is no path to code execution, data disclosure or privilege gain from this flaw.

The CVSS 3.1 base score is 7.5 (High) driven entirely by availability impact: AV:N/AC:L/PR:N/UI:N means the attacker needs only network reach to an AD FS endpoint, with no authentication, no user interaction and low complexity - a realistically triggerable remote DoS. However, the impact ceiling is bounded: C:N/I:N/A:H confirms no confidentiality or integrity loss, so successful exploitation degrades availability (federated logon outage) rather than compromising the host. No EPSS score, SSVC decision, or KEV entry was provided, and no POC is referenced, so there is no evidence of active or automatable exploitation at this time. The practical priority is elevated for organizations whose AD FS is internet-facing and business-critical (an outage blocks SSO to Microsoft 365 and other relying parties), but lower where AD FS is internal-only or already fronted by network controls. Note the missing EPSS/SSVC/POC signals: risk here is inferred from the CVSS vector and product exposure, not from confirmed exploitation telemetry.

An attacker with network access to an internet-facing AD FS endpoint sends a crafted request whose oversized field overflows a fixed-size stack buffer, crashing the AD FS process. Because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), repeated requests can keep the service down, blocking single sign-on to Microsoft 365 and other relying parties. No public exploit is identified at time of analysis.