CVE-2025-59258 Overview
CVE-2025-59258 is an information disclosure vulnerability in Microsoft Active Directory Federation Services (AD FS). The flaw stems from insertion of sensitive information into a log file [CWE-532], allowing a local attacker with access to the affected system to read data that should have remained protected. Microsoft rates the issue as medium severity, and it affects supported versions of Windows Server from 2012 through 2025. No public exploit code, proof of concept, or evidence of exploitation in the wild has been reported at the time of publication.
Critical Impact
A local attacker who can access AD FS log files may recover sensitive federation data, aiding follow-on identity attacks against federated applications and services.
Affected Products
- Microsoft Windows Server 2012 and 2012 R2
- Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2
- Microsoft Windows Server 2025
Discovery Timeline
- 2025-10-14 - CVE-2025-59258 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-59258
Vulnerability Analysis
AD FS provides single sign-on and federated identity services for enterprise environments. It handles claims, tokens, and credentials for downstream applications and partner organizations. This vulnerability results from AD FS writing sensitive information into log files during normal operation. An unauthorized local attacker who can read those logs can then obtain data intended to remain confidential inside the identity infrastructure.
The underlying weakness maps to CWE-532, Insertion of Sensitive Information into Log File. Logs are useful forensic artifacts, but they must exclude tokens, secrets, and identity material. When those values reach disk in plaintext, the security boundary provided by AD FS erodes. The disclosed data can support impersonation, token replay, or targeted phishing against federated relying parties.
Root Cause
The root cause is improper handling of sensitive fields during AD FS event and diagnostic logging. Data that should be redacted or omitted is instead serialized into log entries accessible to accounts with sufficient local access on the AD FS server.
Attack Vector
Exploitation requires local access to the AD FS server or to any location where its log files are stored or shipped. No user interaction and no prior privileges on AD FS itself are required by the CVSS metric, but the attacker must reach the log store. The impact is scoped to confidentiality; integrity and availability are not affected. See the Microsoft Security Update Guide for CVE-2025-59258 for vendor-published technical notes.
Detection Methods for CVE-2025-59258
Indicators of Compromise
- Unexpected read access to AD FS log directories such as %ProgramData%\Microsoft\ADFS or forwarded copies in SIEM archives.
- Copy, compression, or exfiltration of AD FS event logs by non-administrative accounts or unusual processes.
- Anomalous federation token usage or replay against relying party applications following log exposure.
Detection Strategies
- Audit file system access to AD FS log paths and any centralized log storage that ingests AD FS events.
- Correlate file access events with process lineage to identify unauthorized log reads outside expected maintenance tools.
- Review AD FS admin, security, and debug logs for sensitive fields that indicate the vulnerability produced disclosable content.
Monitoring Recommendations
- Ship AD FS logs to a centralized platform with strict role-based access controls and tamper-evident storage.
- Alert on interactive logons to AD FS servers by accounts that are not part of the identity operations team.
- Baseline normal log-access behavior for backup and monitoring agents, and alert on deviations.
How to Mitigate CVE-2025-59258
Immediate Actions Required
- Apply the Microsoft security update referenced in the vendor advisory for each affected Windows Server version running AD FS.
- Restrict local and administrative access to AD FS servers to a minimal set of tier-0 identity administrators.
- Rotate signing, token-decryption, and service account credentials if you have evidence that AD FS logs were accessed by unauthorized parties.
Patch Information
Microsoft has released updates addressing CVE-2025-59258 across Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025. Refer to the Microsoft Security Update Guide for CVE-2025-59258 for the specific KB articles and package versions that apply to each supported release.
Workarounds
- Tighten NTFS and share permissions on AD FS log directories so only tier-0 administrators and required service accounts can read them.
- Reduce AD FS diagnostic and verbose logging levels where operationally acceptable until patches are deployed.
- Encrypt log volumes at rest and ensure log-forwarding pipelines terminate in access-controlled storage.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
