CVE-2026-50304: Windows 10 1607 AD FS DoS Vulnerability

CVE-2026-50304 Overview

CVE-2026-50304 is a stack-based buffer overflow vulnerability in Microsoft Active Directory Federation Services (AD FS). An unauthenticated attacker can send crafted network traffic to a vulnerable AD FS endpoint and trigger a denial of service condition. The flaw is tracked under [CWE-121: Stack-based Buffer Overflow] and affects a broad range of Windows Server releases that host the AD FS role.

Microsoft assigned CVSS 3.1 base score 7.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The impact is limited to availability, but AD FS outages break federated single sign-on (SSO) for connected relying parties, including Microsoft 365 and SaaS applications.

Critical Impact
An unauthenticated remote attacker can crash the AD FS service and disrupt federated authentication for every downstream application that relies on it.

Affected Products

Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 with the AD FS role installed
Microsoft Windows 10 version 1607 (x86 and x64)
Microsoft Windows 10 version 1809 (x86 and x64)

Discovery Timeline

2026-07-14 - CVE-2026-50304 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50304

Vulnerability Analysis

The vulnerability resides in the AD FS request-processing path, where a fixed-size stack buffer receives attacker-controlled data without adequate length validation. When the input exceeds the buffer boundary, adjacent stack memory is overwritten. In this instance the corruption terminates the AD FS worker process rather than yielding code execution, consistent with the availability-only CVSS impact metrics.

AD FS runs as a network-facing service on Windows Server and is typically published to the public internet through a Web Application Proxy (WAP). This exposure means the attack surface is reachable from any host that can connect to the federation endpoint. No credentials, user interaction, or elevated privileges are required to trigger the condition.

Because AD FS mediates authentication tokens for federated relying parties, a sustained crash loop stops SAML and WS-Federation sign-in flows. Downstream services such as Microsoft 365, third-party SaaS, and custom applications lose the ability to authenticate users until the service is restored.

Root Cause

The root cause is missing or insufficient bounds checking on a stack-allocated buffer inside an AD FS request handler. Under [CWE-121], the handler writes beyond the buffer's allocated size, corrupting the stack frame and forcing an unhandled exception that terminates the process.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker sends a specially crafted request to a reachable AD FS endpoint, such as /adfs/ls/ or the federation metadata handler. Repeated requests keep the service in a crash-restart cycle, producing a persistent denial of service against federated authentication.

No public proof-of-concept exploit code has been published for CVE-2026-50304 at the time of writing. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-50304

Indicators of Compromise

Repeated crashes of the adfssrv service in the Windows System event log, often accompanied by Application error events referencing Microsoft.IdentityServer.ServiceHost.exe.
Windows Error Reporting (WER) entries and application crash dumps generated from the AD FS worker process within a short time window.
Spikes in failed federated sign-ins reported by relying parties immediately after unusual inbound traffic to the AD FS or Web Application Proxy endpoints.

Detection Strategies

Monitor Windows Event IDs 1000 and 1026 filtered on Microsoft.IdentityServer.ServiceHost.exe to catch process termination tied to the flaw.
Inspect IIS and AD FS logs for malformed or oversized requests to federation endpoints such as /adfs/ls/, /adfs/services/trust, and /FederationMetadata/2007-06/FederationMetadata.xml.
Correlate Web Application Proxy access logs with AD FS service restarts to attribute inbound requests to the crash events.

Monitoring Recommendations

Alert on any restart of the AD FS service and treat multiple restarts within an hour as a high-severity incident.
Track authentication success rates from federated relying parties to detect availability degradation before end users report outages.
Feed AD FS, IIS, and WAP logs into a centralized analytics platform to build baseline behavior and identify anomalous request patterns.

How to Mitigate CVE-2026-50304

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to every AD FS server and Web Application Proxy in the farm.
Inventory all Windows Server hosts with the AD FS role and prioritize internet-exposed federation servers for patching first.
Enable detailed AD FS and IIS logging before patching so post-patch validation can confirm the crash pattern has stopped.

Patch Information

Microsoft has issued security updates for all affected Windows Server releases (2012, 2012 R2, 2016, 2019, 2022, and 2025) and the listed Windows 10 versions. Consult the Microsoft Security Update Guide for the exact KB numbers per operating system build, and follow standard AD FS farm patching order: secondary nodes first, then the primary, with WAP servers updated last.

Workarounds

Restrict inbound access to AD FS endpoints to trusted networks or through a hardened Web Application Proxy while patching is in progress.
Deploy a Web Application Firewall or reverse proxy rule to drop oversized or malformed requests to /adfs/* paths until updates are applied.
Consider migrating federated applications to Microsoft Entra ID authentication to reduce long-term reliance on on-premises AD FS.

bash

# Verify AD FS role status and recent crashes on a Windows Server host
Get-WindowsFeature ADFS-Federation
Get-Service adfssrv
Get-WinEvent -LogName Application -MaxEvents 200 |
  Where-Object { $_.ProviderName -eq 'Application Error' -and $_.Message -match 'Microsoft.IdentityServer.ServiceHost' }