CVE-2026-50695: Windows 10 1607 AD FS DoS Vulnerability

CVE-2026-50695 Overview

CVE-2026-50695 is a stack-based buffer overflow [CWE-121] in Microsoft Active Directory Federation Services (AD FS). An unauthenticated remote attacker can send crafted network traffic to a vulnerable AD FS endpoint and trigger a denial of service condition. The flaw affects a broad range of Windows client and server releases, including Windows Server 2012 through Windows Server 2025 and multiple Windows 10 and Windows 11 builds. Successful exploitation degrades or interrupts federated authentication, which can cascade into outages for downstream applications relying on AD FS for single sign-on. Microsoft has published an advisory tracking the issue and released updates through the standard update channel.

Critical Impact
An unauthenticated network attacker can crash AD FS and disrupt federated authentication across dependent applications.

Affected Products

Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (24H2, 25H2, 26H1)

Discovery Timeline

2026-07-14 - CVE-2026-50695 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50695

Vulnerability Analysis

The vulnerability resides in the AD FS request-handling path, where an input processed from a network request is copied onto a stack buffer without adequate bounds checking. When the input exceeds the allocated buffer, adjacent stack memory is overwritten, corrupting saved return addresses or control data and causing the AD FS process to terminate. Because AD FS listens for federation and authentication requests over the network, the attack requires no prior credentials and no user interaction. The impact is limited to availability. Confidentiality and integrity are not affected according to the CVSS breakdown published by Microsoft.

Root Cause

The root cause is classified as CWE-121: Stack-based Buffer Overflow. AD FS accepts attacker-controlled data of a size larger than the fixed-length stack buffer that receives it. The absence of a length validation check before the copy operation allows the write to run past the buffer boundary, corrupting the stack frame and triggering a process crash.

Attack Vector

Exploitation is performed over the network against an exposed AD FS service. The attacker sends a malformed request that reaches the vulnerable parsing routine and forces the overflow. Attack complexity is low and no privileges are required. Organizations exposing AD FS to the internet for external federation are at highest risk because the endpoint is reachable from any client that can establish a TCP connection to the service.

No public proof-of-concept exploit code is currently listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.796%.

Detection Methods for CVE-2026-50695

Indicators of Compromise

Unexpected termination of the AD FS service (adfssrv) or repeated process crashes recorded in the Windows Application event log.
Bursts of malformed or oversized requests to AD FS endpoints such as /adfs/ls/ or /adfs/services/trust from a single source.
Federated sign-in failures across multiple relying-party applications occurring simultaneously with AD FS host errors.

Detection Strategies

Monitor Windows Error Reporting and Application event logs for faulting module entries tied to the AD FS process.
Inspect IIS and HTTP.sys logs for anomalous request sizes, unusual URIs, or repeated 5xx responses on AD FS virtual paths.
Correlate AD FS availability alerts with network telemetry to identify the source of malformed traffic.

Monitoring Recommendations

Enable AD FS auditing and forward AD FS/Admin and AD FS/Debug channels to a centralized logging platform.
Alert on service restart events for adfssrv and on sudden drops in successful token issuance rates.
Track failure patterns at the Web Application Proxy layer to catch pre-authentication traffic before it reaches AD FS.

How to Mitigate CVE-2026-50695

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-50695 Advisory to all AD FS servers.
Prioritize internet-facing AD FS and Web Application Proxy hosts before internal-only deployments.
Verify update installation and restart the AD FS service to confirm the fix is loaded.

Patch Information

Microsoft has released updates that address the stack-based buffer overflow through the standard monthly servicing channel. Refer to the Microsoft CVE-2026-50695 Advisory for the specific KB article, build numbers, and per-OS package identifiers that correspond to each supported Windows Server and Windows client release.

Workarounds

Place AD FS behind a Web Application Proxy and enforce request size limits and pre-authentication where the deployment supports it.
Restrict inbound access to AD FS to known federation partners using firewall or reverse proxy rules where feasible.
Enable rate limiting on the AD FS front-end to reduce the impact of repeated malformed requests until patching is complete.

bash

# Verify AD FS service state and recent crashes on a Windows Server host
Get-Service adfssrv
Get-WinEvent -LogName Application -MaxEvents 200 |
    Where-Object { $_.ProviderName -like '*ADFS*' -or $_.LevelDisplayName -eq 'Error' }