CVE-2026-50324

What it actually does

This vulnerability is a remotely reachable denial-of-service flaw in Active Directory Federation Services caused by a loop with an unreachable exit condition. An unauthenticated network attacker who can reach AD FS endpoints may be able to send specially crafted traffic that causes the AD FS service to enter an infinite loop, consuming resources or making federation endpoints unavailable. The primary impact is availability loss; confidentiality and integrity are not directly affected. Exploitation is rated high complexity, and no public exploit maturity or CISA KEV listing is currently reported.

Why it matters to the business

Successful exploitation can disrupt single sign-on and federated authentication for applications that rely on AD FS, potentially preventing employees, partners, or customers from accessing business-critical services. Because AD FS is often central to authentication, an outage can have a broad operational impact even though the flaw does not directly expose data or allow code execution. The current EPSS score is low and there is no known KEV or ransomware association, but internet-exposed federation services should still be prioritized because authentication outages can quickly become business-impacting incidents.

How an attack unfolds

An attacker first identifies an organization’s exposed AD FS federation service and confirms that vulnerable Windows or Windows Server versions are in use with AD FS enabled. The attacker then sends crafted network requests to AD FS endpoints designed to trigger the vulnerable loop condition. If successful, the AD FS service may become CPU-bound, stop responding, or fail to process authentication flows. Users attempting to sign in through federation may see timeouts, errors, repeated redirects, or failed token issuance. The attacker does not need credentials or user interaction, but the attack requires specific conditions or request construction consistent with the high attack complexity rating.

How to fix it

Apply the applicable Microsoft security updates for all affected Windows and Windows Server systems that host or support AD FS. Because exact fixed build numbers were not provided, use Microsoft’s official security update guidance for the July 2026 release or later and verify that each affected OS version is fully patched. Prioritize servers with the AD FS role installed, especially internet-facing federation servers and Web Application Proxy deployments. If immediate patching is not possible, reduce exposure by restricting access to AD FS endpoints to trusted networks where feasible, placing AD FS behind protective reverse proxies or WAF controls, rate-limiting suspicious request patterns, ensuring redundant AD FS capacity, and monitoring for abnormal CPU, memory, request volume, or authentication failure spikes. Mitigations should be treated as temporary and not a substitute for patching.

How to confirm the fix worked

Confirm that all AD FS servers and related proxy systems have installed the relevant Microsoft security updates released on or after the vendor fix date. Validate the operating system build and cumulative update level using standard Windows update inventory tools, vulnerability scanners, or Microsoft update compliance reporting. Confirm that the AD FS role is either not installed on systems where it is unnecessary or is patched where it is required. Perform functional sign-in tests against federation endpoints after patching to ensure token issuance and relying-party authentication flows still work. Validate exposure by checking that only intended AD FS endpoints are reachable from the internet and that access controls, rate limits, and monitoring remain active.

Typical attack path

1. Identify externally reachable AD FS endpoints such as federation metadata, passive sign-in, or WS-Trust services.
2. Fingerprint the target to determine whether AD FS is likely running on an affected Windows or Windows Server release.
3. Send crafted unauthenticated network requests intended to trigger the infinite-loop condition.
4. Sustain or repeat the request pattern until AD FS worker processes consume resources or federation endpoints become unavailable.
5. Cause downstream sign-on failures for applications and services that depend on AD FS.

How to detect it

Investigate whether AD FS experienced unexplained availability degradation, high CPU usage, process hangs, service restarts, or authentication failures since the vulnerability became public. Review Windows Event Logs, especially AD FS Admin, AD FS Tracing/Debug if enabled, System, Application, IIS logs where applicable, Web Application Proxy logs, reverse proxy logs, firewall logs, load balancer telemetry, and endpoint performance data. Look for bursts of unauthenticated requests to AD FS endpoints followed by degraded service health, elevated CPU in Microsoft.IdentityServer.ServiceHost.exe, HTTP 500/503 responses, request timeouts, repeated connection resets, or abnormal traffic from a small number of source IPs. Correlate spikes in requests to /adfs/ endpoints with service-control events for adfssrv, user reports of sign-in failures, token issuance errors, or federation metadata/sign-in endpoint unavailability. There are no known public exploit-specific payload strings for this issue, so detection should focus on behavior: unusual AD FS request volume, high resource consumption, and authentication service instability.

• Microsoft.IdentityServer.ServiceHost.exe
• adfssrv
• Microsoft-Windows-ADFS/Admin
• Microsoft-Windows-ADFS/Tracing
• /adfs/ls/
• /adfs/services/trust/
• /FederationMetadata/2007-06/FederationMetadata.xml
• HTTP 503
• HTTP 500
• The Active Directory Federation Services service terminated unexpectedly
• The Active Directory Federation Services service entered the stopped state
• The Active Directory Federation Services service entered the running state

What your security team should do

• Inventory all systems running AD FS, including federation servers and Web Application Proxy servers, and map them to affected Windows versions.
• Prioritize patching internet-exposed AD FS infrastructure and any AD FS systems supporting high-value or business-critical applications.
• Monitor AD FS availability, CPU utilization, request rates, HTTP error rates, authentication failures, and service restarts for signs of attempted denial of service.
• Review perimeter controls to ensure AD FS endpoints are exposed only where required and protected by rate limiting, DDoS controls, and appropriate reverse proxy logging.
• Ensure AD FS high availability and failover are functioning so a single overloaded federation server does not cause a broad authentication outage.
• Create SIEM detections for unusual bursts of unauthenticated requests to AD FS endpoints and correlated spikes in AD FS service resource consumption.
• Because this issue is not currently in KEV and has low EPSS, schedule remediation according to exposure and authentication criticality, but do not defer patching for public-facing federation services.