CVE-2026-50304

What it actually does

CVE-2026-50304 is a network-reachable stack-based buffer overflow in Microsoft Active Directory Federation Services (AD FS). An unauthenticated attacker can send crafted network traffic to an affected AD FS service and trigger memory corruption that causes the service process to crash. The assigned CVSS vector indicates low attack complexity, no authentication, no user interaction, and high availability impact, with no expected confidentiality or integrity impact from the disclosed behavior.

Why it matters to the business

Successful exploitation can make AD FS unavailable, disrupting federated authentication and single sign-on for applications that rely on it. This can prevent users, partners, and service accounts from accessing business applications, cloud services, and identity-integrated systems until the AD FS service is restarted, failover occurs, or patches/mitigations are applied. Although it is not currently listed in CISA KEV and no public exploit maturity is reported, the affected product set includes widely deployed Windows Server versions, so exposed AD FS endpoints should be prioritized because outages in identity infrastructure can have broad operational impact.

How an attack unfolds

An attacker first identifies an internet-facing or internally reachable AD FS endpoint on an affected Windows Server or Windows installation. The attacker then sends a specially crafted request or sequence of requests to the AD FS network service. Because the vulnerable code mishandles input on the stack, the crafted traffic corrupts process memory and causes the AD FS service process to terminate or become unstable. The practical result is denial of service: authentication flows depending on AD FS begin to fail, users may see sign-in errors, and Windows service control or clustering may repeatedly restart or fail over the service. Based on the provided intelligence, exploitation is not known to provide code execution, credential theft, or data modification, but repeated triggering can sustain an authentication outage.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-50304 for all affected Windows and Windows Server versions running AD FS. No exact fixed build numbers were provided in the input, so administrators should use Microsoft Update, WSUS, Configuration Manager, or the Microsoft Security Update Guide to identify and deploy the applicable July 2026 or later cumulative/security update for Windows 10 1607, Windows 10 1809, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Prioritize internet-facing AD FS servers, federation proxies/Web Application Proxies, and any systems supporting critical authentication flows. Where immediate patching is not possible, reduce exposure by restricting access to AD FS endpoints to trusted networks and upstream proxies, enforcing rate limits and request filtering at reverse proxies or WAFs where feasible, validating AD FS farm failover behavior, and ensuring service monitoring automatically alerts on repeated crashes. Mitigations should be treated as temporary because the vulnerability is unauthenticated and network reachable.

How to confirm the fix worked

Confirm each affected system has installed the relevant Microsoft security update for its Windows version and that no unpatched AD FS nodes remain in the farm. Validate through patch inventory, Windows Update history, WSUS/Configuration Manager compliance, or the Microsoft Security Update Guide mapping for this CVE. Confirm AD FS is operational after patching by testing representative federation sign-in flows, token issuance, metadata retrieval, and relying-party authentication. Review service stability after the update by checking that the AD FS service remains running and that recent Windows System and Application logs do not show repeated AD FS crashes. Also verify that internet-facing exposure is limited to intended AD FS or proxy endpoints and that health checks, load balancers, and failover nodes route only to patched systems.

Typical attack path

1. Discover an exposed AD FS service through DNS, certificate transparency, scanning, or known federation endpoints.
2. Confirm the service is reachable over the network without requiring prior authentication.
3. Send malformed or oversized protocol input targeting the vulnerable AD FS handling path.
4. Trigger stack memory corruption in the AD FS service process.
5. Cause the AD FS process or Windows service to crash, restart, or become unavailable.
6. Repeat requests as needed to sustain denial of service or overwhelm failover/recovery mechanisms.

How to detect it

There are no unique public payload indicators provided for this vulnerability, so detection should focus on signs of attempted denial of service and AD FS process instability. Review Windows System logs for Service Control Manager events showing the AD FS service stopping, crashing, or repeatedly restarting. Review Windows Application logs for application crash events involving Microsoft.IdentityServer.ServiceHost.exe or adfssrv. Review Windows Error Reporting artifacts for crash reports tied to the AD FS service process. Review AD FS Admin, Tracing/Debug, and operational logs for bursts of errors immediately preceding service termination. Correlate crash times with IIS/HTTP.SYS, reverse proxy, WAF, load balancer, firewall, and VPN logs for repeated unauthenticated requests to AD FS endpoints from the same source IPs, unusual request sizes, malformed requests, or spikes in 400/500-series responses. Also look for repeated service recovery actions, failover events, or authentication failure spikes at the same time as process crashes. Since this vulnerability causes availability impact rather than known code execution, absence of persistence artifacts does not rule out exploitation; the strongest signal is a repeatable pattern of crafted network requests followed by AD FS service crashes.

• Microsoft.IdentityServer.ServiceHost.exe
• adfssrv
• Active Directory Federation Services
• The Active Directory Federation Services service terminated unexpectedly
• Faulting application name: Microsoft.IdentityServer.ServiceHost.exe
• Faulting application name: adfssrv.exe
• Event ID 7031
• Event ID 7034
• Event ID 1000
• Event ID 1001
• Windows Error Reporting
• /adfs/ls/
• /adfs/services/trust/
• /FederationMetadata/2007-06/FederationMetadata.xml

What your security team should do

• Inventory all AD FS servers, AD FS farm nodes, and federation proxy/Web Application Proxy systems across affected Windows versions.
• Prioritize patching externally reachable AD FS infrastructure and any AD FS servers supporting critical workforce, partner, or customer authentication.
• Use Microsoft Update, WSUS, Configuration Manager, or equivalent tooling to deploy the applicable July 2026 or later security update, then confirm all farm members are updated.
• Temporarily restrict access to AD FS endpoints, apply reverse-proxy rate limiting, and monitor for repeated unauthenticated requests if patching cannot be completed immediately.
• Increase monitoring for AD FS service crashes, Windows Error Reporting events, service-control restart events, and spikes in federation sign-in failures.
• Validate AD FS high availability and failover behavior so a single service crash does not create a full authentication outage.
• Because this is not currently in CISA KEV and exploit maturity is reported as none, treat this as high-priority availability risk rather than confirmed active exploitation, while continuing to monitor vendor and threat-intelligence updates.