Microsoft AD FS EUVD-2026-99618

Requires the target to be running Active Directory Federation Services (AD FS) on an affected, unpatched Windows Server build (Server 2016/2019/2022/2025 or the corresponding Windows 10 1607/1809 identity builds per EUVD), with the AD FS endpoint reachable over the network by the attacker. Exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N), but the CVSS AC:H rating signals that the attacker must meet specific, not-easily-controlled preconditions for the authentication-spoofing to succeed (e.g., particular request/timing or configuration state), which is the principal factor limiting reliable real-world exploitation. SSVC Automatable=no further indicates it cannot be dependably mass-exploited.

This is a genuinely high-severity issue (CVSS 8.1) but the real-world signals are mixed and point to lower immediate operational risk than the score alone suggests. The CVSS vector (AV:N/PR:N/UI:N) confirms a network-reachable, unauthenticated spoofing weakness in AD FS with total impact (C:H/I:H/A:H), yet AC:H indicates exploitation requires specific, hard-to-control conditions, which materially constrains practical attack reliability. CISA's SSVC framework reinforces this: Exploitation=none (no observed or confirmed exploitation), Automatable=no (cannot be reliably scripted/mass-exploited), and Technical Impact=total. The vulnerability is NOT in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here - this is a notable data gap. Net assessment: a serious identity-federation flaw worth prioritized patching given the 'total' impact on an authentication backbone, but the combination of high attack complexity, non-automatable exploitation, and no evidence of active exploitation means it is not an emergency drop-everything item like a KEV-listed, automatable flaw would be.

A remote, unauthenticated attacker on the network reaches an organization's AD FS endpoint and abuses the weak authentication logic to spoof a federated identity, causing AD FS to treat the attacker as a legitimate principal. Because AD FS brokers single sign-on, a successful spoof could grant access to downstream federated applications (e.g., cloud/SaaS or internal relying parties) as the impersonated user. No public POC is referenced, and the CVSS AC:H rating indicates the attacker must satisfy specific non-trivial conditions to make the spoof succeed.