CVE-2026-50355: AD Federation Services DoS Vulnerability

CVE-2026-50355 Overview

CVE-2026-50355 is a stack-based buffer overflow vulnerability in Microsoft Active Directory Federation Services (AD FS). An unauthenticated remote attacker can send specially crafted network traffic to trigger the overflow and cause the AD FS service to become unavailable. The flaw is classified under CWE-121: Stack-based Buffer Overflow and impacts availability only, with no confidentiality or integrity impact. Microsoft published the advisory through the Microsoft Security Response Center.

Critical Impact
Successful exploitation causes denial of service against AD FS, disrupting federated authentication for downstream applications and cloud services relying on AD FS for single sign-on.

Affected Products

Microsoft Active Directory Federation Services (AD FS)
Windows Server deployments hosting the AD FS role
Federated applications and services depending on AD FS for authentication

Discovery Timeline

2026-07-14 - CVE-2026-50355 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50355

Vulnerability Analysis

The vulnerability resides in the network-facing request handling code of AD FS. A stack-based buffer overflow occurs when input from a remote attacker exceeds the fixed-size buffer allocated on the stack. Overwriting adjacent stack memory corrupts execution state and causes the AD FS process to terminate abnormally.

Because AD FS brokers federated authentication for both on-premises and cloud-integrated applications, a service outage propagates to every relying party. Users cannot complete SAML or WS-Federation flows while the service is unavailable. The vulnerability requires no privileges and no user interaction, and it can be exploited across the network.

Root Cause

The root cause is missing or insufficient bounds checking on data received over the network before it is copied into a stack buffer. Under [CWE-121], the code writes attacker-controlled bytes past the intended buffer boundary. This corrupts the return address or adjacent local variables, forcing the process to crash rather than continue serving requests.

Attack Vector

Exploitation is performed over the network with low attack complexity. An attacker sends a crafted request to an exposed AD FS endpoint, typically over HTTPS on TCP/443. No authentication is required because AD FS accepts unauthenticated protocol messages during federation flows. The scope remains unchanged, and only availability is impacted, meaning the attacker cannot read secrets or forge tokens through this flaw alone.

Refer to the Microsoft CVE-2026-50355 Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-50355

Indicators of Compromise

Repeated unexpected crashes or restarts of the adfssrv service on Windows Servers hosting the AD FS role.
Windows Application event log entries showing faulting module errors tied to AD FS binaries.
Sudden spikes in malformed or oversized HTTPS requests to AD FS federation endpoints such as /adfs/ls/ and /adfs/services/trust.

Detection Strategies

Monitor Windows Event IDs related to service crash and automatic restart of the AD FS Windows Service.
Correlate AD FS availability drops with inbound traffic anomalies at perimeter web application firewalls or reverse proxies fronting AD FS.
Alert on repeated authentication endpoint failures from a single source IP within short time windows, which may indicate DoS probing.

Monitoring Recommendations

Enable and forward AD FS diagnostic and admin logs to a central log platform for continuous review.
Track service health metrics for adfssrv and the underlying HTTP.sys request queues.
Baseline normal request volumes to federation endpoints and alert on statistically significant deviations.

How to Mitigate CVE-2026-50355

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-50355 Advisory to all Windows Servers running the AD FS role.
Restrict inbound access to AD FS endpoints to only required source networks and known federation partners where feasible.
Ensure the Web Application Proxy (WAP) tier fronting AD FS is patched and hardened to filter malformed requests.

Patch Information

Microsoft has released a security update addressing CVE-2026-50355. Administrators should consult the Microsoft Security Response Center advisory to identify the correct update package for each affected Windows Server version and deploy it through standard Windows Update or WSUS channels.

Workarounds

Place AD FS behind a Web Application Proxy or reverse proxy that enforces request size and format validation on federation traffic.
Rate-limit unauthenticated requests to /adfs/* endpoints at the edge to reduce the impact of repeated exploitation attempts.
Configure high availability with multiple AD FS farm nodes so that a single crashed node does not eliminate federated authentication.

bash

# Verify AD FS service state and recent crashes on a Windows Server host
Get-Service adfssrv
Get-WinEvent -LogName Application -MaxEvents 200 | Where-Object { $_.ProviderName -like "*ADFS*" -or $_.Message -match "adfssrv" }