CVE-2026-54983

What it actually does

CVE-2026-54983 is a network-reachable stack-based buffer overflow in Microsoft Active Directory Federation Services (AD FS). An unauthenticated attacker can send specially crafted network traffic to an affected AD FS service and trigger memory corruption that causes the AD FS process or service to crash. Based on the published impact, the issue is assessed as denial-of-service only: confidentiality and integrity are not expected to be directly affected, but availability of federation and authentication services can be disrupted.

Why it matters to the business

Successful exploitation can interrupt AD FS-backed single sign-on, federation, and authentication flows, which may prevent users and applications from accessing Microsoft 365, cloud services, SaaS applications, VPNs, and internal applications that rely on AD FS. Because the flaw is remotely reachable, requires no authentication, and has low attack complexity, internet-exposed AD FS deployments are the highest priority even though the vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score at this time.

How an attack unfolds

An attacker first identifies an exposed AD FS endpoint, typically over HTTPS on TCP/443. The attacker then sends malformed or oversized requests designed to exercise the vulnerable parsing path in AD FS. When the crafted input is processed, it overflows a stack buffer and corrupts process memory. In the known described impact scenario, this causes the AD FS service process to terminate or become unstable, resulting in authentication failures for relying parties until the service is restarted or the host recovers. Repeated requests could be used to sustain an outage. There is no public indication from the supplied data that reliable code execution exists, that exploitation is occurring in the wild, or that named threat actors are using this vulnerability.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-54983 for all affected Windows client and Windows Server platforms running AD FS, including Windows Server 2012, 2016, 2019, 2022, and 2025 where AD FS is enabled. Because no exact fixed build or KB version was provided, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, or equivalent patch tooling to identify and deploy the applicable July 2026 or later cumulative/security update for each affected operating system. Prioritize externally reachable AD FS servers and federation proxies. If immediate patching is not possible, reduce exposure by restricting access to AD FS endpoints to trusted networks where feasible, placing AD FS behind protective reverse proxies or WAF controls, rate-limiting abnormal request patterns, ensuring service auto-recovery is enabled, and maintaining redundant AD FS nodes to reduce outage impact. Mitigations should not be treated as a replacement for patching.

How to confirm the fix worked

Confirm that each AD FS server and proxy is running a Windows build containing the vendor fix by checking installed cumulative/security updates against the Microsoft Security Update Guide for CVE-2026-54983. Verify that the AD FS Windows service starts cleanly and remains stable after patching. Test representative authentication flows, including IdP-initiated and SP-initiated sign-on, federation metadata retrieval, OAuth/OIDC flows if used, and trust endpoints used by relying parties. From an exposure standpoint, verify whether /adfs/ endpoints are reachable from the internet and confirm that only intended hosts and network paths can access them. Review vulnerability scanner results, asset inventory, and patch management compliance reports to ensure no affected AD FS nodes remain unpatched.

Typical attack path

1. Identify organizations exposing AD FS endpoints to the internet or reachable network segments.
2. Confirm AD FS is responding on common federation paths such as /adfs/ls/ or federation metadata endpoints.
3. Send specially crafted unauthenticated network requests intended to trigger the stack-based buffer overflow.
4. Cause the AD FS service process to crash or become unresponsive.
5. Repeat requests as needed to maintain denial of service and disrupt authentication-dependent business services.

How to detect it

To determine whether exploitation may already have occurred, review Windows Application logs, System logs, AD FS Admin logs, AD FS Tracing/Debug logs if enabled, Windows Error Reporting events, IIS or HTTP.sys logs if present, reverse proxy logs, WAF logs, and load balancer telemetry. Focus on unexplained crashes or restarts of the AD FS service, especially when preceded by bursts of unauthenticated requests to /adfs/ endpoints from the same source or unusual user agents. Look for Application Error events involving Microsoft.IdentityServer.ServiceHost.exe, Windows Error Reporting records for the same process, and Service Control Manager events showing the AD FS service terminated unexpectedly. Correlate crash timestamps with spikes in HTTP 400/500 responses, authentication failures, failed federation requests, or health probe failures. Because this vulnerability is described as denial-of-service and no exploit-specific payload pattern was provided, detection should emphasize behavioral evidence: service instability, repeated malformed requests, abnormal traffic volume to AD FS paths, and source IPs repeatedly associated with crashes.

• Microsoft.IdentityServer.ServiceHost.exe
• adfssrv
• Active Directory Federation Services service terminated unexpectedly
• The Active Directory Federation Services service terminated unexpectedly
• Event ID 1000
• Event ID 1001
• Event ID 7031
• Event ID 7034
• Faulting application name: Microsoft.IdentityServer.ServiceHost.exe
• Windows Error Reporting
• /adfs/ls/
• /adfs/services/trust
• /adfs/oauth2/
• /adfs/discovery/
• /FederationMetadata/2007-06/FederationMetadata.xml
• AD FS Admin
• AD FS Tracing
• MSIS

What your security team should do

• Prioritize patching internet-facing AD FS servers, Web Application Proxies, and federation infrastructure before less exposed systems.
• Use Microsoft Security Update Guide or enterprise patch tooling to map the correct fixed cumulative/security update to each affected Windows version.
• Review external attack surface for exposed /adfs/ endpoints and remove or restrict unnecessary public access.
• Enable and validate AD FS service recovery, load balancing, and high availability to reduce business impact from service crashes.
• Monitor AD FS, Windows Application, System, HTTP, reverse proxy, and WAF logs for repeated crashes, malformed requests, or spikes in unauthenticated traffic to AD FS endpoints.
• Create SIEM detections for AD FS process crashes, Service Control Manager termination events, and repeated requests to federation endpoints followed by authentication failures.
• Because this is not currently KEV-listed, has no known ransomware use, and has low EPSS, treat it as a high-availability patching priority rather than confirmed active exploitation unless local telemetry indicates otherwise.