CVE-2026-50647

What it actually does

CVE-2026-50647 is a network-reachable denial-of-service flaw in Active Directory Federation Services (AD FS) caused by a loop with an unreachable exit condition. An unauthenticated attacker can send specially crafted network traffic to an exposed AD FS service and trigger an infinite loop, causing excessive CPU consumption, service thread exhaustion, or AD FS service unresponsiveness. The impact is availability only: the vulnerability does not directly provide code execution, data disclosure, or privilege escalation, but it can interrupt authentication and federation services.

Why it matters to the business

Successful exploitation can disrupt single sign-on and federated authentication for applications that depend on AD FS, potentially preventing users, administrators, partners, or automated services from logging in. For organizations that rely on AD FS for access to Microsoft, SaaS, internal, or partner-facing applications, this can cause broad operational outages, help desk volume spikes, failed business workflows, and degraded incident response capability. The vulnerability has a high availability score and is remotely exploitable without authentication, but it is not currently listed in CISA KEV and the provided exploit maturity is None, so urgency should be based on AD FS exposure and business criticality.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable AD FS endpoint. Because the flaw requires no authentication, the attacker does not need valid credentials or prior access. The attacker then sends crafted network requests that exercise the vulnerable AD FS code path containing an infinite loop. When processed, the AD FS service can consume excessive compute resources or become unable to process legitimate authentication traffic. The attacker may repeat or parallelize the requests to maintain the outage, causing users and dependent applications to experience login failures, timeout errors, or intermittent authentication disruption. There is no indication from the provided data that this vulnerability is being used by named threat actors, ransomware campaigns, or is currently in CISA KEV.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-50647 for all affected Windows and .NET Framework versions in use, prioritizing AD FS servers and any systems hosting federation components. Because no exact fixed build numbers were provided, use Microsoft Update, Windows Server Update Services, Microsoft Update Catalog, or the relevant Microsoft Security Update Guide entry to identify and deploy the applicable cumulative update for each supported platform. Prioritize externally reachable AD FS servers, AD FS proxy/Web Application Proxy systems, and high-availability federation farms. If immediate patching is not possible, reduce exposure by restricting AD FS access to required networks, enforcing upstream rate limiting, using web application firewall or reverse proxy controls where applicable, monitoring and blocking abusive sources, and ensuring AD FS farm redundancy and failover are functioning. Mitigations should be treated as temporary because they may reduce exploitability or blast radius but do not correct the vulnerable code path.

How to confirm the fix worked

Confirm remediation by verifying that all AD FS servers, proxies, and related affected Windows/.NET systems have installed the Microsoft security update that supersedes or explicitly fixes CVE-2026-50647. Validate operating system build numbers, installed cumulative updates, and .NET Framework servicing levels against Microsoft’s official update guidance. From an exposure standpoint, inventory all AD FS endpoints and verify that only intended endpoints are reachable from untrusted networks. Operationally, confirm AD FS health after patching by testing federation sign-in flows, token issuance, metadata retrieval, and application authentication paths. Review monitoring for sustained CPU spikes, service hangs, request timeouts, or AD FS service restarts before and after remediation to ensure the condition is no longer observable.

Typical attack path

1. Reconnaissance: identify AD FS endpoints exposed to the internet or reachable from an internal network.
2. Target selection: confirm the endpoint is running a potentially affected AD FS deployment on a vulnerable Windows Server or related Microsoft platform.
3. Trigger: send crafted unauthenticated network requests to the AD FS service that reach the vulnerable infinite-loop condition.
4. Resource exhaustion: force the AD FS process or service to consume CPU, hang request-processing threads, or stop responding reliably.
5. Sustain outage: repeat requests from one or more sources to keep the federation service degraded or unavailable.
6. Operational impact: users and dependent applications experience authentication failures, long login delays, or single sign-on outages.

How to detect it

To determine whether exploitation may already have occurred, review AD FS, Windows Event Logs, proxy, load balancer, firewall, and WAF telemetry for unexplained authentication outages or resource exhaustion affecting AD FS. Focus on the period since publication and any windows with high CPU utilization on AD FS servers, service hangs, service restarts, authentication timeouts, or bursts of unauthenticated requests from a small set of external sources. Useful log sources include Microsoft-Windows-ADFS/Admin, Microsoft-Windows-ADFS/Debug if enabled, System logs for Service Control Manager events, Security logs for authentication anomalies, HTTP proxy and reverse proxy access logs, WAF logs, load balancer health-check failures, and endpoint telemetry for the AD FS service process. Look for correlation between inbound request spikes and AD FS process CPU saturation, token issuance failures, failed health probes, service restarts, or user-reported login failures. Because this is a denial-of-service issue rather than a code execution flaw, durable host artifacts may be limited; detection should emphasize traffic patterns, service health changes, and operational symptoms rather than malware indicators.

• Microsoft-Windows-ADFS/Admin
• Microsoft-Windows-ADFS/Debug
• Microsoft.IdentityServer.ServiceHost.exe
• adfssrv
• Active Directory Federation Services
• The Active Directory Federation Services service terminated unexpectedly
• The Active Directory Federation Services service entered the stopped state
• The Active Directory Federation Services service entered the running state
• Service Control Manager
• Event ID 7031
• Event ID 7036
• /adfs/ls/
• /adfs/services/trust
• /FederationMetadata/2007-06/FederationMetadata.xml
• HTTP 503
• HTTP 504

What your security team should do

• Patch AD FS servers and AD FS proxy/Web Application Proxy systems first, especially any reachable from the internet or partner networks.
• Inventory all AD FS deployments and confirm whether affected Windows Server, Windows client, and .NET Framework versions are present in federation infrastructure.
• Use Microsoft Security Update Guide or enterprise patch tooling to identify the applicable cumulative updates because exact fixed versions were not provided in the input.
• Temporarily restrict network access to AD FS endpoints to trusted sources where business requirements allow.
• Enable or tune rate limiting and abusive-source blocking at reverse proxies, load balancers, firewalls, or WAFs in front of AD FS.
• Increase monitoring for AD FS service availability, CPU saturation, authentication latency, failed sign-ins, and repeated unauthenticated request bursts.
• Ensure AD FS farm redundancy, load balancing, and failover procedures are tested so authentication services can tolerate node-level disruption.
• Review incident response runbooks for federation outage scenarios, including emergency traffic blocking, service restart procedures, and stakeholder communications.
• Because the vulnerability is not currently KEV-listed and exploit maturity is reported as None, prioritize based on exposure and authentication criticality rather than evidence of widespread exploitation.