CVE-2026-50684

What it actually does

This is a cross-site scripting flaw in Active Directory Federation Services (AD FS). A vulnerable AD FS page does not correctly neutralize attacker-controlled input before generating HTML, allowing script content to execute in a victim browser under the AD FS web origin. Exploitation requires a highly privileged or otherwise authorized attacker and user interaction, but successful execution can let the attacker spoof trusted AD FS content, manipulate the sign-in or federation user experience, and potentially read or alter limited browser-accessible information associated with the AD FS session.

Why it matters to the business

Because AD FS is commonly part of enterprise authentication and single sign-on, even a moderate-severity spoofing flaw can have outsized operational impact if abused in a phishing or trust-manipulation scenario. An attacker could make malicious content appear to come from a legitimate authentication service, increasing the chance of credential capture, MFA fatigue, token-handling abuse, or user redirection. The CVE is not currently listed in CISA KEV, is not flagged as ransomware-used, and has no known mature public exploit in the provided data, but it affects multiple Windows Server and Windows client versions that may host or support AD FS deployments, so internet-facing federation services should be prioritized for timely patching and exposure review.

How an attack unfolds

An attacker with the required authorized access identifies an AD FS web page or federation flow that reflects or embeds input into generated HTML without sufficient encoding. The attacker crafts a URL, request, or input value containing script-capable markup and delivers it to a target user, typically by email, chat, helpdesk workflow, or another trusted channel. When the user opens the crafted AD FS page or follows the manipulated authentication flow, the browser renders the page as if it came from the legitimate AD FS service and executes the injected script in that origin. The script can alter the visible page, display convincing spoofed prompts, redirect the user, or attempt to collect browser-accessible data. The practical impact depends on browser protections, AD FS configuration, custom sign-in pages, token storage behavior, and whether compensating controls such as WAF rules and strict content security policy are in place.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows and Windows Server systems running AD FS or related federation components. The input does not provide exact fixed build numbers or package versions, so administrators should validate against Microsoft’s official update guidance for this CVE and ensure Windows 10 1607, Windows 10 1809, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems are updated to a release that includes the fix. Patch all AD FS farm nodes and any Web Application Proxy servers in a coordinated maintenance window. If immediate patching is not possible, restrict access to AD FS administrative and federation endpoints where feasible, review and reduce privileged AD FS access, deploy WAF or reverse-proxy rules to block script-like input in AD FS request parameters, avoid custom AD FS page code that echoes request data, and consider enforcing a restrictive Content Security Policy where supported and tested.

How to confirm the fix worked

Confirm that every AD FS server and Web Application Proxy is running an operating system build and cumulative update level that Microsoft documents as fixed for this CVE. Validate that no unsupported or unpatched affected versions remain in the AD FS farm. From a security testing workstation, verify that representative AD FS endpoints safely encode HTML metacharacters such as less-than, greater-than, quotes, and JavaScript URI schemes rather than rendering them as executable content. Review external exposure to ensure only intended AD FS endpoints are reachable from the internet. Confirm that WAF, reverse proxy, and monitoring rules log and block obvious XSS payloads without disrupting normal federation flows.

Typical attack path

1. Gain or use authorized access sufficient to reach the vulnerable AD FS functionality.
2. Identify an AD FS page or parameter that is rendered back into the web response without proper output encoding.
3. Craft a malicious AD FS URL or request containing HTML or JavaScript payload content.
4. Lure a target user into opening the crafted link or interacting with the affected AD FS flow.
5. Execute script in the victim browser under the AD FS web origin.
6. Spoof the authentication experience, redirect the user, or attempt limited data access or session manipulation.
7. Use any captured information or induced user action to support follow-on phishing, credential abuse, or access attempts.

How to detect it

To determine whether exploitation was already attempted, review web access logs from AD FS, Web Application Proxy, IIS/HTTP.sys, load balancers, reverse proxies, and WAFs for requests to AD FS paths containing script tags, event-handler attributes, JavaScript URIs, or heavily encoded HTML. Correlate suspicious requests with AD FS Admin, AD FS Tracing, Windows Security, and identity-provider sign-in logs to identify the authenticated account that sent the payload and any users who subsequently interacted with the crafted link. Pay particular attention to requests involving /adfs/ls/, /adfs/oauth2/authorize, /adfs/oauth2/token, /adfs/services/trust, and customized AD FS sign-in pages. Look for referrer values or query strings containing encoded markup, followed by unusual redirects, repeated authentication prompts, MFA anomalies, credential failures, or new sign-ins from unexpected user agents or locations. Endpoint telemetry may show browsers launched with AD FS URLs containing encoded script payloads, but web, proxy, and WAF logs are usually the most useful sources for this class of issue.

• /adfs/
• <script
• %3cscript
• %253cscript
• </script>
• %3c%2fscript%3e
• javascript:
• %6a%61%76%61%73%63%72%69%70%74%3a
• onerror=
• onload=
• onclick=
• document.cookie
• window.location
• document.location
• eval(
• alert(
• prompt(
• confirm(
• <img
• %3cimg
• <svg
• %3csvg
• srcdoc=
• <iframe
• %3ciframe

What your security team should do

• Inventory all AD FS servers, Web Application Proxy servers, and Windows hosts exposing AD FS-related endpoints.
• Apply Microsoft security updates to affected systems, prioritizing internet-facing AD FS and federation infrastructure.
• Confirm patch status by OS build and installed cumulative update rather than relying only on asset tags or vulnerability scanner labels.
• Search AD FS, IIS, WAF, proxy, and identity-provider logs for script-like payloads targeting /adfs/ endpoints since publication on 2026-07-14.
• Review privileged AD FS and federation administration accounts for unnecessary access and recent suspicious activity.
• Add or tune detection rules for encoded and unencoded XSS payloads in AD FS URLs, query strings, form posts, and referrers.
• Inspect custom AD FS sign-in page customizations for unsafe rendering of request parameters or user-controlled values.
• If exploitation is suspected, review authentication events around the affected sessions for unusual redirects, MFA prompts, failed logons, new device sign-ins, and token or session anomalies.