CVE-2026-50411

What it actually does

CVE-2026-50411 is a remotely reachable stack-based buffer overflow in Microsoft Active Directory Federation Services (AD FS). An unauthenticated network attacker can send specially crafted traffic to an exposed AD FS service and corrupt stack memory in a way that causes the AD FS process or service to terminate. Based on the published impact, the flaw affects availability only: it is not currently described as enabling data disclosure, authentication bypass, privilege escalation, or remote code execution.

Why it matters to the business

Organizations that rely on AD FS for single sign-on, federation, or identity brokering may experience authentication outages if the vulnerable service is attacked. A successful denial-of-service condition can prevent users, applications, partners, or cloud-integrated services from signing in, which may disrupt business operations even though confidentiality and integrity are not the primary impacts. The issue is network-exploitable, requires no credentials or user interaction, and has a high availability impact, so internet-facing or partner-facing AD FS deployments should be treated as higher priority even though it is not listed in CISA KEV and no mature exploit is currently reported.

How an attack unfolds

An attacker first identifies an AD FS endpoint exposed over the network, commonly over HTTPS. They then send a crafted request or sequence of requests designed to trigger the stack-based buffer overflow in the vulnerable AD FS component. Because exploitation does not require authentication, the attacker can perform the attack from any network path that can reach the AD FS service. When the malformed input is processed, the AD FS service may crash or become unresponsive, interrupting authentication flows. The attacker can repeat the request to keep the service unavailable, causing a sustained denial of service until the service is patched, restarted with effective mitigations, or shielded from the malicious traffic.

How to fix it

Apply the relevant Microsoft security update for all affected Windows and .NET Framework installations that host or support AD FS. Because no exact fixed versions were provided in the input, use the latest Microsoft cumulative updates, servicing stack updates, and .NET Framework security updates applicable to Windows Server 2012, 2016, 2019, 2022, 2025, supported Windows 10 and Windows 11 versions, and any AD FS or Web Application Proxy systems in the federation path. Prioritize servers running the AD FS role and any internet-facing federation infrastructure. If immediate patching is not possible, reduce exposure by limiting AD FS access to required networks, enforcing upstream filtering through load balancers, reverse proxies, or web application firewalls, blocking anomalous request patterns to AD FS endpoints, and ensuring service monitoring can quickly restart failed AD FS services. These mitigations reduce risk but should not be treated as a substitute for patching.

How to confirm the fix worked

Confirm exposure by inventorying systems with the AD FS role installed or running AD FS-related services, especially systems reachable from the internet or partner networks. Verify that the applicable Microsoft security updates have been installed on AD FS servers, Web Application Proxy servers, and supporting Windows/.NET systems. Confirm that AD FS services restart successfully after patching and that federation sign-in flows continue to work. Validate that network controls restrict access to AD FS endpoints to expected sources where feasible. Review vulnerability scanner results, Windows update inventory, and package/compliance tooling to ensure no affected OS or .NET Framework versions remain unpatched on systems hosting AD FS.

Typical attack path

1. Discover an exposed AD FS service through internet scanning, partner network access, or internal reconnaissance.
2. Confirm that AD FS endpoints are reachable, typically over HTTPS on federation URLs such as /adfs/.
3. Send a malformed network request crafted to trigger the stack-based buffer overflow.
4. Cause the AD FS service process to crash, hang, or restart.
5. Repeat the request to create a persistent authentication outage or to disrupt dependent applications and services.

How to detect it

Look for evidence of attempted or successful denial of service against AD FS by correlating AD FS service instability with inbound network activity. Useful sources include Windows Application logs, System logs, AD FS Admin and Debug logs, IIS logs if AD FS traffic is logged through IIS or a proxy, Web Application Proxy logs, load balancer and reverse proxy logs, firewall logs, EDR process telemetry, and Windows Error Reporting crash artifacts. Investigate Application Error events involving Microsoft.IdentityServer.ServiceHost.exe or adfssrv, Service Control Manager events showing unexpected AD FS service termination or restart, and repeated requests to /adfs/ endpoints from the same source shortly before crashes. Since the described impact is denial of service rather than code execution, focus on crash timing, repeated malformed requests, service restarts, memory dump creation, and abnormal request volume rather than persistence artifacts. No public KEV listing, ransomware association, named threat actor, or mature exploit is currently reported in the supplied data, so detection should emphasize behavioral anomalies and service-failure correlation rather than actor-specific indicators.

• Microsoft.IdentityServer.ServiceHost.exe
• adfssrv
• Active Directory Federation Services service terminated unexpectedly
• The Active Directory Federation Services service terminated unexpectedly
• Service Control Manager
• Event ID 7031
• Event ID 7034
• Application Error
• Event ID 1000
• Windows Error Reporting
• Event ID 1001
• /adfs/
• /adfs/ls/
• /adfs/services/trust
• /adfs/oauth2/
• /adfs/.well-known/openid-configuration
• AD FS/Admin
• AD FS Tracing/Debug
• %ProgramData%\Microsoft\Windows\WER\ReportArchive
• %ProgramData%\Microsoft\Windows\WER\ReportQueue

What your security team should do

• Prioritize patching internet-facing AD FS servers and federation proxy infrastructure before lower-exposure systems.
• Inventory all systems running AD FS, Web Application Proxy, or federation-related services and verify applicable Microsoft security updates are installed.
• Enable or review monitoring for AD FS service crashes, repeated service restarts, application faults, and abnormal request spikes to /adfs/ endpoints.
• Restrict inbound access to AD FS endpoints to required networks and trusted upstream proxies where business requirements allow.
• Ensure AD FS high availability and failover are functioning so that a single service crash does not create a full authentication outage.
• Create SIEM alerts for AD FS process crashes, Service Control Manager restart events, and repeated unauthenticated requests immediately preceding AD FS failures.
• Review identity service incident response runbooks for denial-of-service scenarios affecting federation and single sign-on.