Microsoft AD FS EUVD-2026-99934

Requires network reachability to the AD FS service - in practice an internet-exposed AD FS federation endpoint or Web Application Proxy, the standard deployment for external federated sign-in. No authentication, privileges, or user interaction are needed (PR:N/UI:N), so default internet-facing AD FS configurations are exploitable. Exploitation is limited to organizations that actually run the AD FS role (not all Windows Server installs) and is substantially mitigated when AD FS is reachable only from internal networks or placed behind upstream rate-limiting/WAF controls; impact is confined to availability of the federation service, with no data compromise.

This is a genuine but moderate-priority availability issue, not a top-tier emergency. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the CWE-770 description: a remote, unauthenticated attacker can send unthrottled requests to an internet-facing AD FS endpoint to exhaust resources and deny service, with no confidentiality or integrity impact. The signals align rather than conflict: CISA SSVC lists Exploitation as 'none' (no observed or public exploitation), which matches the absence of any KEV listing or POC in the provided data, while SSVC Automatable='yes' is consistent with a scriptable, unauthenticated network DoS. SSVC Technical Impact is 'partial' - reasonable for a pure availability loss with no code execution or data exposure. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. The high CVSS is driven entirely by the A:H availability leg; because there is no C/I impact and the worst case is service disruption of the federation/SSO service (not compromise), real-world urgency is lower than the 7.5 headline implies for most organizations, though AD FS being an authentication gateway means an outage can cascade to every relying application. Prioritize patching for internet-exposed AD FS proxies; internally-only-reachable deployments are lower risk.

An attacker who can reach the AD FS service over the network (typically via an internet-facing Web Application Proxy / AD FS endpoint) sends a flood or specially shaped stream of requests that the service accepts without adequate rate limiting, causing unbounded resource allocation that exhausts CPU, memory, or connection capacity. Legitimate federated sign-ins then fail, taking down single sign-on for all dependent applications. No public exploit identified at time of analysis, and no authentication is required.