CVE-2026-50368

What it actually does

CVE-2026-50368 is a remotely reachable stack-based buffer overflow in Microsoft Active Directory Federation Services (AD FS). An unauthenticated attacker can send crafted network traffic to the AD FS service that overflows a stack buffer and causes the service or hosting process to crash. Based on the published impact, the confirmed outcome is denial of service: availability loss for AD FS, rather than data disclosure or privilege escalation.

Why it matters to the business

Successful exploitation can interrupt federated authentication and single sign-on services. Organizations that rely on AD FS for access to Microsoft 365, SaaS applications, VPN, third-party applications, or internal web applications may experience login failures, user lockout from business systems, help desk surges, and operational disruption. The issue is network-exploitable without credentials and has a high availability impact, but it is not currently listed in CISA KEV and no mature public exploit is indicated, which lowers immediate mass-exploitation urgency compared with actively exploited vulnerabilities.

How an attack unfolds

An attacker identifies an exposed AD FS endpoint or federation service listener and sends a malformed request designed to exceed the bounds of a stack-allocated buffer in the vulnerable AD FS code path. Because the vulnerability requires no authentication, the attacker does not need valid domain, federation, or application credentials. If the crafted input reaches the vulnerable parser or handler, memory corruption occurs and the AD FS service process can terminate or become unstable. Repeated requests can keep the service unavailable, causing authentication outages for relying-party applications until the service is restarted and the vulnerable system is patched or otherwise protected.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-50368 for all affected Windows Server, Windows client, .NET Framework, and AD FS deployments. Prioritize internet-facing AD FS servers, Web Application Proxy systems, and federation infrastructure supporting critical applications. Because no fixed version list was provided, use the applicable Microsoft Security Update Guide entry for this CVE and deploy the latest cumulative updates for the affected operating system and .NET Framework versions. Where immediate patching is not possible, reduce exposure by restricting AD FS access to required networks, placing AD FS behind properly configured reverse proxies or Web Application Proxy, enforcing rate limiting and request filtering at upstream controls, and ensuring redundant AD FS nodes are available to absorb single-node failures. Mitigations should not be treated as a substitute for patching.

How to confirm the fix worked

Confirm that each affected host has installed the relevant Microsoft security update for CVE-2026-50368 through Microsoft Update, WSUS, Configuration Manager, Intune, or other patch inventory tooling. Validate the OS and .NET Framework patch level against the Microsoft Security Update Guide. Verify that AD FS services remain healthy after patching, federation metadata is accessible, token issuance works for representative relying-party applications, and no unexpected AD FS service crashes occur during normal authentication traffic. For exposure validation, inventory externally reachable AD FS endpoints and confirm unnecessary public access is removed or restricted.

Typical attack path

1. Identify an organization exposing AD FS or related federation endpoints to the network or internet.
2. Confirm reachable AD FS endpoints such as federation metadata, sign-in, or token service paths.
3. Send crafted unauthenticated network requests intended to trigger the stack-based buffer overflow.
4. Cause the AD FS service or its hosting process to crash, hang, or restart.
5. Repeat the request pattern to sustain denial of service and disrupt authentication-dependent applications.

How to detect it

To determine whether exploitation may have already occurred, review AD FS, Windows System, Application, HTTP.SYS, IIS, reverse proxy, WAF, and network logs for unexplained AD FS service crashes or restarts correlated with bursts of unauthenticated requests to federation endpoints. Focus on events showing abnormal termination of the AD FS service process, repeated service recovery actions, Windows Error Reporting crash records, application fault events, and traffic spikes to AD FS paths shortly before outages. Compare source IPs, user agents, request paths, request sizes, and error rates around the crash window. Look for repeated requests from the same source or distributed sources immediately followed by Event ID 7031/7034 service termination events, Application Error event 1000, Windows Error Reporting event 1001, or AD FS administrative errors indicating service instability. Because the vulnerability is a denial-of-service condition and no public exploit indicators were provided, detection should rely primarily on behavioral correlation rather than a single definitive IOC.

• Event ID 7031
• Event ID 7034
• Event ID 1000
• Event ID 1001
• Active Directory Federation Services service terminated unexpectedly
• The Active Directory Federation Services service terminated unexpectedly
• adfssrv
• Microsoft.IdentityServer.ServiceHost.exe
• /adfs/ls/
• /adfs/services/trust/
• /FederationMetadata/2007-06/FederationMetadata.xml
• AD FS Windows Service
• Windows Error Reporting
• Application Error

What your security team should do

• Patch internet-facing and business-critical AD FS infrastructure first, including redundant nodes and Web Application Proxy tiers.
• Inventory all AD FS servers and affected Windows/.NET Framework versions across production, disaster recovery, and test environments.
• Review whether AD FS endpoints are unnecessarily exposed to the internet and restrict access where business requirements allow.
• Enable or verify monitoring for AD FS service crashes, Windows Error Reporting events, IIS/HTTP request anomalies, and repeated unauthenticated requests to federation endpoints.
• Prepare an operational recovery plan for AD FS denial-of-service events, including service restart procedures, failover validation, and authentication outage communications.
• Track Microsoft Security Update Guide advisories for any changes in exploitability assessment, workaround guidance, or known exploitation status.