Microsoft AD FS EUVD-2026-99750

Exploitation requires AD FS (or a .NET application using the affected System.Security.Cryptography.Xml / .NET Framework certificate-validation path) to be reachable by the attacker over the network, and the attacker must be able to supply a certificate that the flawed validation improperly trusts - in practice a man-in-the-middle/relay position or a crafted forged certificate presented to the federation endpoint. No authentication is required (PR:N) and no user interaction is needed (UI:N), so default AD FS deployments are in scope once network-reachable. The principal limiting factor is CVSS AC:H: the attacker must first obtain the privileged network/intercept position or construct a certificate that bypasses validation, which raises the bar above trivial remote exploitation. Impact is confined to spoofing/impersonation (C:H/I:H) with no availability effect (A:N), and the flaw does not cross a trust/scope boundary (S:U).

Signals are moderate and largely consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N, base 7.4) describes an unauthenticated, network-reachable spoofing flaw rooted in improper certificate validation (CWE-295), but the AC:H metric is the key moderating factor - successful exploitation realistically requires a privileged network position or the ability to present a crafted/forged certificate, not a simple one-shot request. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was provided. The notable tension is between the advisory title ('AD FS') and the EUVD affected-version list, which is dominated by .NET Framework, System.Security.Cryptography.Xml, Windows Server and even Visual Studio - this indicates the real defect lives in the underlying .NET XML/cryptography certificate-validation code consumed by AD FS, which broadens the patch footprint well beyond AD FS servers; verify applicability per deployed component. Net: a credible, Microsoft-confirmed and patched spoofing issue worth prioritizing on internet-facing AD FS/federation endpoints, but AC:H plus the absence of any exploitation signal places it below drop-everything critical.

An attacker positioned to intercept or inject traffic between a client and an AD FS federation endpoint (or a .NET application using the affected XML/crypto certificate-validation path) presents a certificate that is improperly accepted as valid. Because the flawed validation does not correctly reject the forged or mismatched certificate, the attacker spoofs a trusted identity/endpoint and can impersonate it to harvest tokens or relay authentication. No public exploit code is identified at time of analysis, and the CVSS AC:H reflects that the attacker must first achieve the network/MITM position or craft a suitable certificate.