CVE-2026-50355

What it actually does

This vulnerability is a remotely reachable stack-based buffer overflow in Active Directory Federation Services. An unauthenticated attacker can send a specially crafted network request to an affected AD FS service, corrupt stack memory, and cause the service process to crash. Based on the assigned impact, the expected outcome is denial of service rather than data theft or privilege escalation: confidentiality and integrity are not directly affected, but availability of federation and token issuance services can be disrupted.

Why it matters to the business

Successful exploitation can interrupt single sign-on and federated authentication for applications that depend on AD FS, potentially blocking users, partners, and services from accessing business applications. Because the flaw is network-exploitable, requires no credentials, and has low attack complexity, externally reachable AD FS deployments are the highest priority even though there is currently no known KEV listing, ransomware association, or mature public exploit reported. Organizations using affected Windows Server, Windows client, and .NET Framework versions should treat exposed AD FS infrastructure as availability-critical and patch promptly to avoid authentication outages.

How an attack unfolds

An attacker first identifies an AD FS endpoint exposed to the network, commonly through federation metadata, sign-in, token, or proxy-facing URLs. They then send a malformed request designed to overflow a stack buffer in the AD FS handling path. The overflow causes the AD FS service process to terminate or become unstable. If the service manager restarts the service, the attacker can repeat the request to create a persistent or intermittent denial-of-service condition. The practical effect is disruption of federation workflows such as sign-in, token issuance, and application access for users and relying parties.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-50355 for all affected platforms, including affected versions of Windows Server 2012, 2016, 2019, 2022, 2025, Windows 10, Windows 11, and Microsoft .NET Framework where AD FS components are present. No exact fixed build numbers were provided in the input, so use the applicable July 2026 or later cumulative/security updates from Microsoft for each operating system and .NET Framework version. Prioritize AD FS federation servers, Web Application Proxy servers, and any systems exposing AD FS endpoints to untrusted networks. Where immediate patching is not possible, reduce exposure by restricting access to AD FS endpoints to required networks, placing services behind DDoS-capable filtering or reverse proxies, enabling rate limiting where available, and ensuring AD FS farms have sufficient redundancy. These mitigations reduce exploitability and impact but should not be treated as substitutes for patching.

How to confirm the fix worked

Confirm that all AD FS servers, AD FS proxy servers, and systems hosting affected components have the relevant Microsoft security updates installed. Validate by checking Windows Update, Microsoft Update Catalog KB installation status, endpoint management compliance reports, or OS build information against Microsoft’s advisory for the affected platform. Verify that AD FS services restart cleanly after patching and that federation metadata, sign-in, token issuance, and relying-party authentication flows operate normally. From an exposure standpoint, confirm that only intended AD FS endpoints are reachable from untrusted networks and that network controls block unnecessary access. Vulnerability scanners should be updated to detect this issue by installed patch level rather than by banner alone.

Typical attack path

1. Identify an internet-facing or reachable AD FS service or AD FS proxy endpoint.
2. Confirm the endpoint is running an affected Microsoft Windows, Windows Server, or .NET Framework-supported AD FS deployment.
3. Send a crafted unauthenticated network request that triggers the stack-based buffer overflow.
4. Cause the AD FS service process to crash or become unavailable.
5. Repeat the request to keep the service unstable and prolong authentication outage.
6. Monitor service availability externally to time repeated denial-of-service attempts.

How to detect it

Look for evidence of AD FS service instability, repeated crashes, or authentication outages correlated with inbound network requests. Relevant log sources include Windows System logs, Windows Application logs, AD FS Admin logs, AD FS Tracing/Debug logs if enabled, Web Application Proxy logs, reverse proxy or load balancer logs, WAF logs, firewall logs, and endpoint detection telemetry from AD FS servers. Search for repeated crashes of the AD FS service process, service-control-manager restart events, application fault events, and unusual spikes of unauthenticated requests to AD FS endpoints immediately before crashes. Pay particular attention to recurring requests from the same external source IPs, malformed or unusually large requests, abnormal HTTP status patterns, and repeated access to federation, token, sign-in, or metadata endpoints followed by service termination. Because no public exploit maturity or named threat actor activity is provided, detection should focus on behavioral indicators of attempted denial of service rather than a known exploit signature.

• Microsoft.IdentityServer.ServiceHost.exe
• adfssrv
• Active Directory Federation Services service terminated unexpectedly
• The Active Directory Federation Services service terminated unexpectedly
• Event ID 7031
• Event ID 7034
• Event ID 1000
• Faulting application name: Microsoft.IdentityServer.ServiceHost.exe
• Faulting module name: Microsoft.IdentityServer
• AD FS/Admin
• /adfs/ls/
• /adfs/services/trust
• /FederationMetadata/2007-06/FederationMetadata.xml

What your security team should do

• Prioritize patching internet-facing AD FS and Web Application Proxy infrastructure before lower-risk internal systems.
• Inventory all AD FS federation servers, proxy servers, and affected Windows/.NET Framework hosts to confirm patch coverage.
• Review AD FS availability monitoring for unexplained restarts, crashes, or authentication outages since publication on 2026-07-14.
• Add temporary network-layer protections such as access restrictions, rate limiting, and DDoS filtering for externally reachable AD FS endpoints until patching is complete.
• Ensure AD FS farms have redundancy and tested failover so a single service crash does not cause a full authentication outage.
• Correlate AD FS service crashes with inbound requests from the same source IPs to identify possible exploitation attempts.
• Update incident response playbooks for authentication-service denial of service, including communications to application owners and help desk teams.