CVE-2026-85319: AD FS Denial of Service Vulnerability

CVE-2026-85319 Overview

CVE-2026-85319 is a denial-of-service vulnerability in Microsoft Active Directory Federation Services (AD FS). The flaw stems from improper allocation of resources without limits or throttling [CWE-770]. An unauthenticated attacker can exhaust AD FS resources over the network, disrupting federated authentication for dependent applications and services.

Microsoft published the vulnerability on October 13, 2026, through the MSRC Update Guide. The issue requires no privileges, no user interaction, and is reachable over the network. Successful exploitation impacts availability of AD FS, which brokers authentication for Microsoft 365, SaaS platforms, and internal relying parties.

Critical Impact
Unauthenticated network attackers can exhaust AD FS resources and interrupt single sign-on for every relying party that depends on the federation service.

Affected Products

Microsoft Active Directory Federation Services (AD FS)
Windows Server deployments hosting the AD FS role
Federated applications and services relying on AD FS for authentication

Discovery Timeline

2026-10-13 - CVE-2026-85319 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85319

Vulnerability Analysis

AD FS exposes HTTPS endpoints that handle federated authentication requests, including WS-Trust, WS-Federation, SAML, and OAuth flows. The service accepts and processes incoming requests without sufficient controls on how many resources each request can consume. Attackers abuse this missing throttling to force the service into a resource-exhausted state.

Because AD FS brokers sign-in for Microsoft 365 and other relying parties, degradation of the service cascades to every application that depends on it. Users cannot complete federated sign-in, token issuance stalls, and existing sessions fail to refresh. The attacker gains no access to data or configuration, but availability loss alone can halt business operations.

Root Cause

The root cause maps to CWE-770: Allocation of Resources Without Limits or Throttling. AD FS request handlers process attacker-controlled input without enforcing hard caps on memory, threads, connections, or request rates. A single source can issue enough requests, or sufficiently expensive requests, to consume capacity reserved for legitimate traffic.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the AD FS endpoints published on the internet or internal network and submits a crafted volume or shape of requests. Microsoft has not published proof-of-concept exploit code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Microsoft CVE-2026-85319 Update Guide for vendor technical details.

Detection Methods for CVE-2026-85319

Indicators of Compromise

Sudden spikes in AD FS request volume from a single source IP or small set of IPs against /adfs/ls/, /adfs/services/trust, or /adfs/oauth2/ endpoints.
AD FS worker process (Microsoft.IdentityServer.ServiceHost.exe) exhibiting sustained high CPU, memory growth, or thread count saturation.
Event log entries in the AD FS Admin and Operational channels showing request timeouts, token issuance failures, or dropped connections.

Detection Strategies

Correlate AD FS performance counters (Token Requests/sec, Federation Metadata Requests/sec) with request logs to identify anomalous surge patterns.
Monitor Web Application Proxy (WAP) telemetry for repeated failed or slow requests forwarded to AD FS backend servers.
Baseline normal federated sign-in rates per relying party and alert on deviations that align with service degradation.

Monitoring Recommendations

Ingest AD FS and WAP IIS logs into a centralized SIEM for correlation with authentication failure rates across downstream relying parties.
Track Microsoft 365 and SaaS sign-in success rates; sudden drops often indicate AD FS availability issues.
Alert on reverse proxy or load balancer thresholds for connection counts and request latency to AD FS listeners.

How to Mitigate CVE-2026-85319

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory on every AD FS and Web Application Proxy server.
Restrict exposure of AD FS endpoints to required networks only, publishing externally through a hardened Web Application Proxy rather than directly.
Enable Extranet Smart Lockout and request throttling features on AD FS to limit abusive traffic.

Patch Information

Microsoft has released a security update addressing CVE-2026-85319. Refer to the Microsoft CVE-2026-85319 Update Guide for the specific KB articles and build numbers that apply to each supported Windows Server version hosting AD FS. Apply updates to primary and secondary AD FS farm members, as well as any Web Application Proxy servers.

Workarounds

Deploy rate limiting and connection throttling at the perimeter load balancer or WAF in front of AD FS endpoints.
Enable geo-blocking or source-IP allowlists for federation endpoints where business requirements allow.
Consider migrating authentication to Microsoft Entra ID with pass-through authentication or managed federation to reduce AD FS exposure.

bash

# Example: enable Extranet Smart Lockout on AD FS to limit abusive request patterns
Set-AdfsProperties -EnableExtranetLockout $true `
  -ExtranetLockoutThreshold 10 `
  -ExtranetObservationWindow (New-TimeSpan -Minutes 10) `
  -ExtranetLockoutMode AdfsSmartLockoutEnforce