Microsoft AD FS EUVD-2026-99460

Exploitation requires that the Active Directory Federation Services (AD FS) role be installed and its endpoint be network-reachable by the attacker - in most real deployments this means the AD FS / Web Application Proxy service is exposed to the internet or to a reachable internal network. No authentication, credentials, or user interaction are needed (PR:N/UI:N), and attack complexity is low. The primary limiting factor is deployment scope: only hosts actually running the AD FS role on the listed unpatched Windows Server/Windows build ranges are affected, so environments that do not deploy AD FS or that restrict access to its endpoints are not exposed. Impact is confined to availability (service denial); confidentiality and integrity are unaffected.

This is a genuine but bounded operational risk, not a crisis-tier vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a cleanly remote, unauthenticated, low-complexity denial-of-service with no confidentiality or integrity impact - consistent with the CWE-770 uncontrolled resource allocation root cause. CISA's SSVC framing aligns and tempers this: Exploitation=none (no observed exploitation or public PoC), Automatable=yes (the condition can be reliably reached and scripted at scale), and Technical Impact=partial (availability loss of the AD FS service, not full system compromise). There is no CISA KEV listing and no EPSS score provided in the input, so exploitation probability cannot be quantified from this data. The signals are internally consistent rather than conflicting: high CVSS reflects the ease and remote nature of triggering the DoS, while SSVC Exploitation=none and the absence of KEV/PoC indicate it is not currently being used in the wild. The practical priority driver is that AD FS is an internet-facing authentication gateway for many organizations - an outage cascades into federated SSO failures - so despite 'only' an availability impact, patch urgency should be weighted by exposure of the AD FS endpoint. Net: a real, patch-worthy priority for AD FS operators, but currently a potential/automatable DoS rather than a confirmed, actively exploited threat.

A remote, unauthenticated attacker sends crafted or high-volume requests to an internet-reachable AD FS endpoint that cause the service to allocate resources without limit (CWE-770), exhausting memory, threads, or connections. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N and SSVC marks it Automatable=yes, the attack needs no credentials or user interaction and can be scripted against exposed endpoints. The result is loss of availability of the federation service, breaking SSO and downstream authentication; no public exploit code has been identified at time of analysis.