CVE-2026-54983 Overview
CVE-2026-54983 is a stack-based buffer overflow [CWE-121] in Microsoft Active Directory Federation Services (AD FS). An unauthenticated remote attacker can send crafted network traffic to an AD FS endpoint and trigger the overflow, causing the service to crash. The flaw affects a broad set of Windows client and server versions that host or interact with AD FS components. Microsoft published the advisory on 2026-07-14, and the entry was last updated on 2026-07-20. No public proof-of-concept, exploit code, or CISA KEV listing is currently associated with this CVE. The current EPSS probability is 0.797%.
Critical Impact
An unauthenticated attacker can remotely crash AD FS, disrupting federated authentication and single sign-on for downstream applications and cloud services.
Affected Products
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
- Microsoft Windows 11 (24H2, 25H2, 26H1) across x64 and ARM64
Discovery Timeline
- 2026-07-14 - CVE-2026-54983 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-54983
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow within Active Directory Federation Services (AD FS), the Microsoft component that provides claims-based authentication and single sign-on for federated identities. AD FS exposes HTTPS endpoints used by clients and relying parties for token issuance and metadata exchange. A crafted network request causes a fixed-size stack buffer to be written beyond its bounds. The result is memory corruption on the stack of the AD FS worker process. In this case, the corruption is used to abort execution rather than gain code control, producing a denial-of-service condition. The confidentiality and integrity impact rated by Microsoft is None, while availability impact is High.
Root Cause
The underlying defect is classified as [CWE-121] — writing to a stack buffer without validating the length of attacker-controlled input. The AD FS parsing path fails to enforce a bound before copying data into the local buffer, allowing adjacent stack memory and control structures to be overwritten.
Attack Vector
Exploitation is performed over the network with no authentication and no user interaction. An attacker who can reach the AD FS endpoints — typically TCP/443 on the AD FS server or via a Web Application Proxy — can send the malformed request directly. Because AD FS is commonly internet-exposed to support federation, the attack surface extends beyond the internal network. Successful exploitation crashes the AD FS service, interrupting SAML, WS-Federation, and OAuth flows for dependent applications, including Microsoft 365 tenants that rely on federated sign-in.
No verified public exploit code is available for CVE-2026-54983. Refer to the Microsoft Security Advisory for vendor-provided technical details.
Detection Methods for CVE-2026-54983
Indicators of Compromise
- Unexpected crashes or restarts of the adfssrv service, with Windows Error Reporting entries referencing the AD FS worker process.
- Application event log entries showing repeated .NET Runtime or IIS worker process (w3wp.exe) faults tied to the AD FS application pool.
- Bursts of malformed HTTPS requests to /adfs/ls/, /adfs/services/trust/, or /FederationMetadata/2007-06/FederationMetadata.xml from a single source.
Detection Strategies
- Monitor for AD FS service state transitions and correlate with inbound HTTPS request patterns to identify crash-and-restart cycles.
- Alert on IIS logs showing abnormally large request bodies or headers directed at AD FS endpoints.
- Track authentication failure spikes across federated relying parties that could indicate AD FS unavailability caused by exploitation attempts.
Monitoring Recommendations
- Forward AD FS admin, security, and IIS logs to a centralized SIEM or data lake for correlation with network telemetry.
- Baseline normal AD FS request volume and payload sizes so anomalous traffic triggers investigation.
- Enable synthetic transactions against AD FS endpoints to detect service degradation quickly.
How to Mitigate CVE-2026-54983
Immediate Actions Required
- Apply the Microsoft security updates for CVE-2026-54983 to all AD FS servers and Web Application Proxy hosts on affected Windows Server versions.
- Inventory internet-exposed AD FS endpoints and prioritize patching for those reachable from untrusted networks.
- Restrict network access to AD FS management interfaces to trusted administrative hosts only.
Patch Information
Microsoft has released fixes through the Microsoft Update Guide. Review the Microsoft Security Advisory for the specific KB articles that apply to each Windows client and server build, and deploy them through Windows Update, WSUS, or your preferred patch management platform.
Workarounds
- Place AD FS behind Web Application Proxy or a reverse proxy that enforces strict request size and schema validation until patches are deployed.
- Rate-limit and geofence inbound traffic to AD FS endpoints to reduce exposure to unauthenticated attackers.
- Ensure AD FS runs under a farm configuration with redundant nodes so a single-node crash does not fully interrupt federated authentication.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
