CVE-2026-50368: AD Federation Services DoS Vulnerability

CVE-2026-50368 Overview

CVE-2026-50368 is a stack-based buffer overflow vulnerability in Microsoft Active Directory Federation Services (AD FS). An unauthenticated remote attacker can trigger the flaw over the network to cause a denial of service condition against the AD FS role. The weakness is categorized under CWE-121: Stack-based Buffer Overflow.

Successful exploitation does not require credentials or user interaction, which lowers the barrier for attackers targeting internet-exposed federation endpoints. AD FS underpins single sign-on (SSO) and identity federation for many enterprise environments, so an outage disrupts authentication to downstream applications and cloud services.

Critical Impact
Unauthenticated network-based denial of service against AD FS, disrupting federated authentication and SSO for dependent applications.

Affected Products

Microsoft Active Directory Federation Services (AD FS)
Windows Server deployments hosting the AD FS role
Federated applications and services relying on AD FS for authentication

Discovery Timeline

2026-07-14 - CVE-2026-50368 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50368

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow within AD FS request processing. An attacker sends a crafted network request to an AD FS endpoint, causing data to be written beyond the bounds of a fixed-size stack buffer. The corruption of stack memory results in a process crash, terminating the AD FS service.

The advisory scopes the impact to availability only, with no confidentiality or integrity loss. Attack complexity is low, and no privileges or user interaction are required, meaning any attacker with network reachability to the AD FS endpoint can attempt exploitation.

Because AD FS is frequently published to the internet through Web Application Proxy (WAP) or reverse proxies, exposed deployments face immediate risk. A repeated exploitation loop can hold the service in a persistent unavailable state, blocking federated logins.

Root Cause

The root cause is improper bounds checking on attacker-controlled input processed on the stack within AD FS. Under CWE-121, a length or size value is trusted or miscalculated before a copy operation, allowing the write to exceed the destination buffer. The resulting corruption of adjacent stack data, including saved return addresses and frame pointers, causes the process to fault.

Attack Vector

Exploitation occurs over the network against an AD FS listener without authentication. The attacker crafts a malformed protocol message sized or shaped to trigger the vulnerable copy operation. Once the buffer boundary is exceeded, the AD FS worker process crashes and federated authentication halts until the service recovers or is restarted.

No verified public proof-of-concept code is available at this time. See the Microsoft CVE-2026-50368 Advisory for authoritative technical details.

Detection Methods for CVE-2026-50368

Indicators of Compromise

Unexpected termination or repeated restarts of the AD FS service process on Windows Server hosts.
Windows Application and System event log entries recording AD FS worker process faults or crash dumps.
Bursts of malformed or oversized requests to AD FS endpoints such as /adfs/ls/, /adfs/services/trust, or /adfs/oauth2/.

Detection Strategies

Monitor AD FS availability with synthetic authentication probes and alert on sudden failure rates.
Correlate Windows Event IDs related to service crashes (for example, Service Control Manager and Application Error events) with AD FS process names.
Inspect reverse proxy and Web Application Proxy logs for anomalous request sizes, malformed headers, or repeated requests from a single source preceding service failures.

Monitoring Recommendations

Enable and forward AD FS audit logs, IIS logs, and Windows Application logs to a centralized SIEM for correlation.
Baseline normal request volume and payload sizes to AD FS endpoints, then alert on statistical deviations.
Track process uptime for the AD FS service and alert on unplanned restarts occurring outside change windows.

How to Mitigate CVE-2026-50368

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-50368 Advisory to all AD FS servers.
Inventory all AD FS deployments, including internet-facing publishing through Web Application Proxy, and prioritize patching for externally exposed instances.
Verify that AD FS servers are covered by monitoring and automated restart policies so any exploitation attempt is detected and mitigated quickly.

Patch Information

Microsoft has published a security update through the Microsoft Security Response Center. Refer to the Microsoft CVE-2026-50368 Advisory for supported Windows Server versions, KB identifiers, and installation guidance. Apply the update through Windows Update, WSUS, or your standard patch management pipeline and restart the AD FS service as directed.

Workarounds

Restrict network access to AD FS endpoints to trusted sources using firewalls and reverse proxy allow lists where feasible.
Deploy a web application firewall or reverse proxy rule set in front of AD FS to filter malformed requests and enforce size limits on headers and payloads.
Where possible, migrate federated applications to Microsoft Entra ID authentication to reduce reliance on on-premises AD FS.

bash

# Example: verify AD FS service status and recent crashes on Windows Server
Get-Service adfssrv
Get-WinEvent -LogName Application -MaxEvents 200 |
  Where-Object { $_.ProviderName -match 'ADFS' -or $_.LevelDisplayName -eq 'Error' } |
  Format-Table TimeCreated, Id, ProviderName, Message -AutoSize