CVE-2026-72978: AD FS Denial of Service Vulnerability

CVE-2026-72978 Overview

CVE-2026-72978 is a denial-of-service vulnerability in Microsoft Active Directory Federation Services (AD FS). The flaw stems from allocation of resources without limits or throttling [CWE-770]. An unauthenticated attacker can send crafted network requests to exhaust server resources and disrupt federated authentication services. Microsoft published the advisory on September 8, 2026.

The vulnerability requires no privileges and no user interaction, but exploitation carries high attack complexity. Successful attacks impact availability without compromising confidentiality or integrity.

Critical Impact
Unauthenticated network attackers can deny AD FS service, disrupting single sign-on (SSO) and federated authentication for downstream applications and cloud services relying on AD FS.

Affected Products

Microsoft Active Directory Federation Services (AD FS)
Windows Server deployments hosting the AD FS role
Federated applications and services depending on AD FS for authentication

Discovery Timeline

2026-09-08 - Microsoft published CVE-2026-72978 advisory
2026-09-08 - CVE-2026-72978 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72978

Vulnerability Analysis

AD FS accepts and processes federation protocol requests over the network without enforcing sufficient limits on resource consumption. When an attacker submits a volume of specifically formed requests, the service allocates memory, threads, or connection handles beyond safe operating thresholds. The service degrades or stops responding, breaking authentication flows for all federated users.

Because AD FS commonly serves as the identity broker for Microsoft 365, SaaS platforms, and internal web applications, downstream service disruption extends beyond the AD FS server itself. Users relying on SAML, WS-Federation, or OAuth flows through AD FS lose access during the outage window.

The attack complexity is high, indicating the attacker must satisfy specific preconditions or timing constraints. Neither confidentiality nor integrity is affected; the impact is limited to availability.

Root Cause

The root cause is uncontrolled resource allocation, classified under [CWE-770]. AD FS fails to enforce rate limits, connection caps, or memory ceilings for a specific class of unauthenticated request processing. Legitimate protocol handling paths consume resources proportional to attacker input rather than being bounded by server policy.

Attack Vector

The attack vector is network-based. An attacker with reachability to the AD FS endpoint (typically TCP/443) submits repeated or oversized requests to exhaust server capacity. No credentials are required, and no user must interact with the attacker. Internet-exposed AD FS servers, common in hybrid identity deployments, face the greatest exposure.

Refer to the Microsoft CVE-2026-72978 Advisory for protocol-level technical details.

Detection Methods for CVE-2026-72978

Indicators of Compromise

Sudden spikes in AD FS request volume from single or distributed source IP addresses
Elevated memory, CPU, or thread consumption on AD FS servers preceding service degradation
Repeated failed authentication timeouts logged in AD FS event logs (Event IDs 364, 1000, 1021)
Application pool recycles or crashes of the adfssrv service in Windows Event Viewer

Detection Strategies

Correlate AD FS request rates with server resource metrics to identify anomalous consumption patterns
Monitor Windows Event Log channels AD FS/Admin and AD FS Tracing/Debug for repeated errors indicating resource pressure
Deploy web application firewall (WAF) rules in front of AD FS to inspect and rate-limit federation protocol traffic
Baseline typical federation traffic patterns and alert on deviations exceeding standard thresholds

Monitoring Recommendations

Continuously monitor the adfssrv service health and IIS worker process memory utilization
Forward AD FS logs to a centralized SIEM for cross-source correlation and long-term retention
Track authentication success and failure rates from downstream relying parties to detect upstream outages quickly
Enable Microsoft Defender for Identity or equivalent identity monitoring on the AD FS infrastructure

How to Mitigate CVE-2026-72978

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-72978 Advisory to all AD FS servers
Restrict inbound access to AD FS endpoints using the Web Application Proxy (WAP) or equivalent reverse proxy with rate limiting
Review AD FS Extranet Smart Lockout and connection throttling configurations for hardening opportunities
Confirm AD FS servers are not directly exposed to the internet without a proxy tier

Patch Information

Microsoft has released a security update addressing CVE-2026-72978. Administrators should consult the Microsoft CVE-2026-72978 Advisory for the specific Windows Server build numbers, KB identifiers, and deployment instructions applicable to their environment.

Workarounds

Front AD FS with the Web Application Proxy or a hardened reverse proxy that enforces per-source rate limits
Configure network-level access controls to restrict AD FS reachability to trusted source ranges where feasible
Enable Extranet Smart Lockout and adjust throttling policies to reduce impact from anomalous request volume
Consider migrating federated authentication to Microsoft Entra ID where operationally viable to reduce AD FS exposure

bash

# Example: Review current AD FS Extranet Lockout configuration on the primary AD FS server
Get-AdfsProperties | Select-Object ExtranetLockoutEnabled, ExtranetLockoutMode, ExtranetLockoutThreshold, ExtranetObservationWindow

# Example: Restart the AD FS service after applying the security update
Restart-Service adfssrv