CVE-2026-83645: AD FS Denial of Service Vulnerability

CVE-2026-83645 Overview

CVE-2026-83645 is a denial of service vulnerability in Microsoft Active Directory Federation Services (AD FS). The flaw results from allocation of resources without limits or throttling, classified as [CWE-770]. An unauthenticated attacker can send crafted requests over the network to exhaust server resources and disrupt federation services.

AD FS provides single sign-on access for federated applications, so an outage affects downstream authentication for connected relying parties. The vulnerability requires no privileges, no user interaction, and is reachable over the network.

Critical Impact
An unauthenticated remote attacker can exhaust AD FS server resources, causing a sustained denial of service that disrupts federated authentication for all dependent applications and services.

Affected Products

Microsoft Active Directory Federation Services (AD FS)
Windows Server deployments hosting the AD FS role
Federated applications and relying parties dependent on AD FS for authentication

Discovery Timeline

2026-10-13 - CVE-2026-83645 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-83645

Vulnerability Analysis

The vulnerability resides in how AD FS allocates resources when processing incoming network requests. The service does not apply sufficient limits or throttling on resource consumption per request or per client. Attackers abuse this behavior to force the server to allocate memory, threads, or connection state beyond sustainable thresholds.

Because AD FS exposes authentication endpoints to the public network in most deployments, the attack surface is reachable without credentials. Successful exploitation produces high availability impact while leaving confidentiality and integrity intact. The outcome is a denial of federated single sign-on across every integrated application.

Root Cause

The root cause is improper resource management as described in [CWE-770] (Allocation of Resources Without Limits or Throttling). AD FS accepts and processes requests without enforcing bounded consumption of server resources. Repeated or concurrent malicious requests therefore accumulate until the service becomes unresponsive.

Attack Vector

The attack vector is network-based with low complexity. The attacker sends a volume of specially shaped requests to AD FS endpoints to trigger unbounded resource allocation. No authentication, user interaction, or local foothold is required, and the attacker does not need prior knowledge of federation configuration.

See the Microsoft Security Response Center advisory for the authoritative technical description and patch metadata.

Detection Methods for CVE-2026-83645

Indicators of Compromise

Sudden spikes in AD FS CPU, memory, or thread utilization without a corresponding business event
Elevated connection counts or request rates from a narrow set of source IP addresses to /adfs/ls/, /adfs/services/trust, or /adfs/oauth2/ endpoints
Repeated authentication timeouts and HTTP 503 responses from AD FS relying parties
Event log gaps or crash events for the AD FS Windows service around the time of the anomaly

Detection Strategies

Baseline normal AD FS request rates and alert on deviations in connections per second, request size, or concurrent sessions
Correlate AD FS Admin and Debug event logs with Windows performance counters for the AD FS process
Monitor upstream load balancers and Web Application Firewalls for sustained request floods targeting AD FS endpoints

Monitoring Recommendations

Enable AD FS extranet smart lockout and request logging, and forward logs to a centralized analytics platform
Track Windows performance counters Process(Microsoft.IdentityServer.ServiceHost)\% Processor Time and private bytes for sustained saturation
Alert on repeated service restarts of the adfssrv service and on health probe failures from AD FS proxies

How to Mitigate CVE-2026-83645

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all AD FS servers and Web Application Proxy nodes
Restrict direct internet exposure of AD FS endpoints behind a Web Application Proxy or reverse proxy that enforces rate limiting
Validate backup and failover procedures so federated authentication can be restored quickly if the service is disrupted

Patch Information

Microsoft has published guidance and patch information in the MSRC update guide for CVE-2026-83645. Administrators should install the update on every AD FS farm node and any Web Application Proxy servers that front them, then verify service health and federation metadata after reboot.

Workarounds

Enforce connection and request rate limits at the load balancer, Web Application Proxy, or upstream WAF protecting AD FS
Enable AD FS Extranet Smart Lockout and tune ExtranetLockoutThreshold and ExtranetObservationWindow to reduce abusive request volume
Limit AD FS endpoint exposure to known partner IP ranges where federation topology allows
Scale out the AD FS farm and increase IIS application pool resource ceilings as a temporary buffer against resource exhaustion

bash

# Example: enable AD FS Extranet Smart Lockout (run on primary AD FS node)
Set-AdfsProperties -EnableExtranetLockout $true `
  -ExtranetLockoutThreshold 10 `
  -ExtranetObservationWindow (New-TimeSpan -Minutes 30) `
  -ExtranetLockoutMode AdfsSmartLockoutEnforce

# Restart the AD FS service to apply changes
Restart-Service adfssrv