CVE-2026-50647: AD FS Infinite Loop DoS Vulnerability

CVE-2026-50647 Overview

CVE-2026-50647 is a denial of service vulnerability in Microsoft Active Directory Federation Services (AD FS). The flaw is a loop with an unreachable exit condition, classified as an infinite loop weakness under [CWE-835]. An unauthenticated remote attacker can send specially crafted network traffic that forces the AD FS service into a non-terminating loop, exhausting CPU resources and rendering federated authentication unavailable.

Critical Impact
Unauthenticated attackers can remotely disrupt AD FS, breaking single sign-on and federated authentication for downstream applications such as Microsoft 365, SaaS services, and internal relying parties.

Affected Products

Microsoft Active Directory Federation Services (AD FS)
Windows Server deployments hosting AD FS roles
Federated relying party applications dependent on AD FS availability

Discovery Timeline

2026-07-14 - CVE-2026-50647 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50647

Vulnerability Analysis

The vulnerability is an infinite loop condition ([CWE-835]) within AD FS request processing. When AD FS receives a malformed or specially crafted request over the network, the affected code path enters a loop whose exit condition can never be satisfied. The worker thread consumes CPU cycles indefinitely, degrading service responsiveness.

Repeated exploitation attempts amplify the impact. Multiple looping threads exhaust available processing capacity, causing AD FS to stop responding to legitimate federated authentication requests. Because AD FS underpins single sign-on for many enterprise and cloud services, an outage cascades into authentication failures across dependent applications.

The EPSS score for this vulnerability is 1.098%, placing it in the 61.98 percentile for likelihood of exploitation activity within the next 30 days.

Root Cause

The root cause is improper loop termination logic in an AD FS request handler. Input parsing or state validation fails to advance the loop counter or update the state variable required to exit the loop. Attacker-controlled input triggers the code path that never resolves to the terminating condition.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted requests to an internet-facing or intranet-facing AD FS endpoint. Because AD FS commonly sits at the network perimeter to service external federation partners, exposed instances present a direct attack surface.

No public proof-of-concept exploit has been published at the time of writing. Refer to the Microsoft Security Update CVE-2026-50647 advisory for authoritative technical details.

Detection Methods for CVE-2026-50647

Indicators of Compromise

Sustained high CPU utilization by the AD FS service process (Microsoft.IdentityServer.ServiceHost.exe) without corresponding legitimate load
AD FS service becoming unresponsive to /adfs/ls/ or /adfs/services/trust/ endpoint requests
Spike in inbound HTTPS traffic to AD FS endpoints from unfamiliar or geographically anomalous sources
Event log entries indicating stalled or timed-out federation requests

Detection Strategies

Monitor AD FS admin and debug event logs for repeated request failures or worker thread anomalies
Baseline normal request volume to AD FS endpoints and alert on volumetric deviations
Inspect proxy and Web Application Firewall (WAF) logs for malformed SAML, WS-Federation, or OAuth request patterns targeting AD FS
Correlate AD FS process CPU spikes with concurrent authentication failures for downstream relying parties

Monitoring Recommendations

Enable Performance Monitor counters for AD FS request latency, active requests, and token issuance rates
Forward AD FS event logs and IIS logs to a centralized SIEM for correlation and long-term analysis
Configure synthetic authentication probes against AD FS to detect availability degradation early
Track connections to TCP 443 on AD FS servers and AD FS Web Application Proxy hosts for anomalous session counts

How to Mitigate CVE-2026-50647

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-50647 advisory to all AD FS servers
Prioritize patching of internet-facing AD FS Web Application Proxy hosts before internal federation servers
Restart the AD FS service after patch installation and validate token issuance for critical relying parties
Review AD FS availability monitoring and incident response runbooks for DoS scenarios

Patch Information

Microsoft has released a security update addressing CVE-2026-50647. Refer to the Microsoft Security Update CVE-2026-50647 advisory for the specific KB articles, affected Windows Server versions, and installation guidance. Apply the update through Windows Update, WSUS, or the Microsoft Update Catalog according to your patch management policy.

Workarounds

Restrict inbound access to AD FS endpoints using network-level ACLs, allowing only required federation partners and client subnets where feasible
Deploy rate limiting and request validation at the AD FS Web Application Proxy or upstream reverse proxy to blunt volumetric abuse
Configure WAF rules to inspect and drop malformed federation protocol requests targeting /adfs/ URIs
Ensure AD FS server capacity and load balancing are configured to absorb transient CPU spikes while patches are staged

bash

# Verify AD FS service status and installed hotfixes on Windows Server
Get-Service adfssrv | Select-Object Status, DisplayName
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Restrict AD FS endpoint access to approved source ranges (example)
New-NetFirewallRule -DisplayName "Restrict AD FS HTTPS" -Direction Inbound `
    -Protocol TCP -LocalPort 443 -RemoteAddress 203.0.113.0/24 -Action Allow