CVE-2026-50411: AD FS DoS Vulnerability via Buffer Overflow

CVE-2026-50411 Overview

CVE-2026-50411 is a stack-based buffer overflow vulnerability in Microsoft Active Directory Federation Services (AD FS). An unauthenticated attacker can exploit the flaw over a network to trigger a denial-of-service (DoS) condition on the affected AD FS server. The vulnerability is tracked under CWE-121: Stack-based Buffer Overflow and requires no user interaction or privileges.

Exploitation disrupts federated authentication services, which can cascade into broader access failures for applications that rely on AD FS for single sign-on (SSO). Microsoft published the advisory in the Microsoft Security Update Guide for CVE-2026-50411.

Critical Impact
A remote, unauthenticated attacker can crash AD FS and disrupt federated authentication for downstream applications and services.

Affected Products

Microsoft Active Directory Federation Services (AD FS)
Windows Server deployments hosting the AD FS role
Applications relying on AD FS for federated single sign-on

Discovery Timeline

2026-07-14 - CVE-2026-50411 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50411

Vulnerability Analysis

The vulnerability resides in the network-facing request handling logic of AD FS. A specially crafted request causes AD FS to write attacker-influenced data beyond the bounds of a fixed-size stack buffer. The overflow corrupts the call stack and terminates the AD FS process, producing a denial-of-service condition.

Because the attack vector is network-based and requires no authentication or user interaction, any host able to reach the AD FS endpoint can trigger the crash. The condition affects availability only. Confidentiality and integrity of federated data are not directly impacted based on the published CVSS vector.

AD FS is a foundational identity component. When it becomes unavailable, users cannot obtain security tokens for downstream relying parties, which breaks Microsoft 365, Azure integrations, and third-party SaaS applications configured for federated SSO.

Root Cause

The root cause is missing or insufficient bounds checking on data copied into a stack-allocated buffer during request parsing. Stack-based buffer overflows [CWE-121] typically arise from unchecked memcpy, strcpy, or similar copy operations that trust attacker-controlled length fields. Microsoft has not published low-level code details, so refer to the Microsoft Security Update Guide for authoritative remediation guidance.

Attack Vector

An attacker sends a malformed protocol message to an internet-exposed or internally reachable AD FS endpoint. Processing the message overruns the vulnerable stack buffer and crashes the service. Repeated requests can sustain the outage for as long as the attacker maintains the traffic.

No verified public proof-of-concept code exists at the time of publication. The current EPSS probability is approximately 0.797%.

Detection Methods for CVE-2026-50411

Indicators of Compromise

Unexpected termination or repeated restarts of the AD FS service (adfssrv) on federation servers.
Windows Application or System event log entries showing access violations or unhandled exceptions in the AD FS process.
Spikes in malformed or oversized requests to /adfs/services/trust and related federation endpoints.
Federated sign-in failures reported by downstream relying parties during otherwise normal operating windows.

Detection Strategies

Alert on AD FS process crashes and service restart events collected from Windows Event Logs.
Inspect AD FS request logs for anomalously large payloads or malformed SOAP and WS-Trust messages.
Correlate a burst of federation authentication failures with inbound traffic anomalies to AD FS servers.

Monitoring Recommendations

Forward AD FS operational and admin event logs, plus IIS logs, to a centralized analytics platform for correlation.
Monitor availability of AD FS endpoints with synthetic authentication probes to detect service disruption quickly.
Track network traffic volume and request size distributions on ports serving AD FS to identify abnormal patterns.

How to Mitigate CVE-2026-50411

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-50411 to all AD FS servers.
Inventory all federation servers and Web Application Proxy (WAP) hosts to confirm patch coverage across the farm.
Restrict inbound access to AD FS endpoints to trusted network ranges wherever business requirements allow.
Verify AD FS high-availability configuration so that a single crashed node does not eliminate authentication capacity.

Patch Information

Microsoft has issued a security update for CVE-2026-50411. Refer to the Microsoft Security Update Guide for the specific KB articles, affected Windows Server versions, and installation instructions. Apply the update to every AD FS server in the farm and to any Web Application Proxy that fronts them.

Workarounds

Place AD FS behind a Web Application Proxy or reverse proxy that enforces request size and schema validation.
Rate-limit inbound requests to federation endpoints at the network edge to reduce exposure to crash-loop attacks.
Restrict AD FS exposure to only the protocols and endpoints required by relying parties, disabling unused bindings.

bash

# Verify AD FS service state and recent crash events on a federation server
Get-Service adfssrv
Get-WinEvent -LogName Application -MaxEvents 200 |
  Where-Object { $_.ProviderName -like 'AD FS*' -or $_.LevelDisplayName -eq 'Error' } |
  Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize