CVE-2026-50695

What it actually does

This vulnerability is a remotely reachable stack-based buffer overflow in Active Directory Federation Services (AD FS). An unauthenticated attacker can send specially crafted network input to an affected AD FS endpoint and corrupt stack memory in the AD FS service process. Based on the assigned impact, the practical security outcome is denial of service: the federation service may crash, restart, become unstable, or stop responding, while confidentiality and integrity are not indicated as impacted.

Why it matters to the business

Organizations using AD FS for single sign-on, federation, or identity-based access can experience authentication outages if the service is targeted. A successful attack may prevent users, applications, partners, or cloud-integrated services from obtaining tokens or completing sign-in flows, which can disrupt business operations even though the flaw is not currently known to be exploited in the wild. The vulnerability is network-accessible, requires no authentication, and affects many supported Windows client and server versions, so internet-facing or broadly reachable AD FS deployments should be prioritized despite the currently low EPSS score and absence from the Known Exploited Vulnerabilities catalog.

How an attack unfolds

An attacker first identifies an exposed AD FS service, commonly by discovering federation endpoints or hosts presenting AD FS-related HTTP/S responses. The attacker then sends malformed or oversized data to the vulnerable network-accessible AD FS component. Because the vulnerable code mishandles input length on the stack, the crafted request triggers memory corruption in the AD FS service process. The expected result is a service crash or hang rather than credential theft or code execution. The attacker may repeat the requests to keep the service unavailable, causing authentication failures for users and dependent applications until the service is patched, shielded, rate-limited, restarted, or otherwise protected.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows and Windows Server versions running AD FS. Fixed package versions were not provided in the input, so administrators should use the latest cumulative update or security update applicable to Windows 10 1607, Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Prioritize internet-facing AD FS servers and federation proxies/Web Application Proxy systems first. If immediate patching is not possible, reduce exposure by restricting inbound access to AD FS endpoints to required networks, placing protective reverse proxies or WAF controls in front of the service where feasible, applying rate limits, monitoring for repeated crash conditions, and ensuring AD FS farms have redundancy so a single service crash does not create a complete authentication outage.

How to confirm the fix worked

Confirm that each AD FS server and federation proxy has the relevant Microsoft security update installed and that the system build level reflects the patched cumulative update. Validate that AD FS services start cleanly after patching and that normal federation flows, token issuance, and relying-party authentication continue to work. From an exposure perspective, inventory AD FS endpoints reachable from the internet or untrusted networks and verify that unnecessary access paths are blocked. Operationally, review Windows Event Logs before and after remediation for recurring AD FS service crashes, Service Control Manager restart events, Windows Error Reporting entries for the AD FS service process, and authentication outage spikes. Successful remediation should show patched OS levels, stable AD FS service uptime, and absence of repeated crash/restart patterns associated with malformed unauthenticated traffic.

Typical attack path

1. Discover an organization’s AD FS endpoint or federation metadata service exposed over the network.
2. Confirm the target is running an affected Windows/AD FS deployment.
3. Send specially crafted unauthenticated network requests to the vulnerable AD FS service endpoint.
4. Trigger a stack-based buffer overflow in the AD FS service process.
5. Cause the AD FS service to crash, restart, hang, or stop accepting authentication traffic.
6. Repeat the request pattern to sustain denial of service and disrupt sign-in flows.

How to detect it

To determine whether exploitation may have already occurred, focus on evidence of AD FS instability correlated with suspicious unauthenticated network traffic. Review Windows System logs for Service Control Manager events showing the AD FS service terminating unexpectedly or being restarted. Review Application logs and Windows Error Reporting for crashes involving Microsoft.IdentityServer.ServiceHost.exe or AD FS-related modules. Review AD FS Admin and Debug logs, IIS logs if AD FS traffic is proxied through IIS components, reverse proxy logs, WAF logs, firewall logs, and load balancer logs for repeated requests to federation endpoints immediately before service crashes or authentication outages. Look for spikes in failed or incomplete requests to /adfs/ endpoints, repeated connections from the same external sources, abnormal request sizes, malformed headers, or bursts that align with service restarts. Because this vulnerability is described as denial of service rather than code execution, durable host artifacts may be limited; the most useful evidence is temporal correlation between network request anomalies and AD FS process crashes or service restarts.

• Microsoft.IdentityServer.ServiceHost.exe
• adfssrv
• Active Directory Federation Services
• The Active Directory Federation Services service terminated unexpectedly
• The adfssrv service terminated unexpectedly
• Event ID 7031
• Event ID 7034
• Windows Error Reporting
• Application Error
• /adfs/
• /adfs/ls/
• /adfs/services/trust
• /FederationMetadata/2007-06/FederationMetadata.xml

What your security team should do

• Identify all AD FS servers, federation proxies, and Web Application Proxy systems, especially those reachable from the internet or partner networks.
• Apply the relevant Microsoft security updates or latest cumulative updates to affected Windows and Windows Server systems running AD FS.
• Prioritize patching production identity infrastructure because AD FS outages can block access to many dependent applications.
• Temporarily restrict AD FS network exposure to required sources if patching cannot be completed immediately.
• Enable or review monitoring for AD FS service crashes, Service Control Manager restart events, Windows Error Reporting events, and unusual bursts of unauthenticated requests to federation endpoints.
• Confirm high availability for AD FS farms and validate failover behavior to reduce the operational effect of a denial-of-service attempt.
• Review perimeter logs, proxy logs, and WAF telemetry for repeated malformed requests or request bursts preceding AD FS instability.
• Create SOC detections for repeated crashes of Microsoft.IdentityServer.ServiceHost.exe or repeated restarts of the adfssrv service.