CVE-2026-85321: AD FS DOS Vulnerability

CVE-2026-85321 Overview

CVE-2026-85321 is a denial-of-service vulnerability in Microsoft Active Directory Federation Services (AD FS). The flaw stems from improper allocation of resources without limits or throttling [CWE-770]. An unauthenticated remote attacker can exhaust server resources by sending crafted requests over the network, causing AD FS to become unresponsive. Because AD FS brokers single sign-on (SSO) and federated authentication for downstream applications, loss of availability cascades to any service that depends on it. The vulnerability requires no privileges and no user interaction, which widens the pool of potential attackers.

Critical Impact
An unauthenticated network attacker can disrupt federated authentication across the enterprise, blocking SSO logins to Microsoft 365, Entra ID relying parties, and any application that depends on AD FS.

Affected Products

Microsoft Active Directory Federation Services (AD FS)
Windows Server deployments hosting the AD FS role
Downstream relying party applications dependent on AD FS tokens

Discovery Timeline

2026-10-13 - CVE-2026-85321 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85321

Vulnerability Analysis

AD FS exposes network-reachable endpoints that process federation protocol messages, including WS-Trust, WS-Federation, SAML, and OAuth/OpenID Connect flows. The vulnerable code path accepts incoming requests and allocates memory, threads, or connection state without enforcing a hard upper bound. An attacker who sends a sustained volume of requests, or specifically crafted requests that consume disproportionate server resources, drives the service into resource exhaustion. The AD FS worker process stops responding to legitimate authentication requests, which breaks SSO for every federated relying party.

The impact is confined to availability. Confidentiality and integrity of tokens, claims, and user data are not affected. However, outage of AD FS typically halts user access to Microsoft 365, Azure-hosted applications, and third-party SaaS platforms that federate to the environment.

Root Cause

The root cause is an allocation of resources without limits or throttling, categorized under [CWE-770]. The affected code path does not cap the number or size of resources consumed per client, per connection, or per time window. Without quotas, rate limiting, or back-pressure, a modest request volume from a single source is sufficient to deplete server capacity.

Attack Vector

The attack vector is network-based with low complexity and no authentication required. An attacker reaches the public AD FS endpoint, typically adfs.<domain>.com on TCP/443, and issues a flood of federation requests. Because AD FS is commonly internet-exposed to support external SSO, the attack surface extends beyond the corporate perimeter. Internet-facing Web Application Proxy (WAP) servers that front AD FS are also exposed to the same traffic patterns.

No public proof-of-concept exploit is listed for this CVE at publication. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-85321

Indicators of Compromise

Sustained spikes in AD FS request rate from a single source IP or small set of IPs, especially targeting /adfs/services/trust/ or /adfs/ls/ endpoints.
AD FS worker process (Microsoft.IdentityServer.ServiceHost.exe) consuming abnormal CPU, memory, or thread counts.
Event ID 1000 or Event ID 364 in the AD FS/Admin log indicating request handling failures or token issuance errors during the spike.
Web Application Proxy (WAP) logs showing a surge of 5xx responses or dropped connections to the backend AD FS farm.

Detection Strategies

Baseline normal AD FS request volumes per endpoint and alert on statistically significant deviations.
Correlate perimeter firewall or load balancer flow data with AD FS server performance counters to identify low-source-diversity floods.
Monitor Windows performance counters AD FS\Token Requests/sec and Process(Microsoft.IdentityServer.ServiceHost)\% Processor Time for sustained anomalies.

Monitoring Recommendations

Forward AD FS audit, admin, and IIS logs to a centralized SIEM for correlation with network telemetry.
Enable AD FS extranet smart lockout and request-level logging to capture source IP metadata.
Alert on authentication outage conditions reported by relying parties, which often surface a DoS condition before internal metrics do.

How to Mitigate CVE-2026-85321

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all AD FS and WAP servers.
Restrict exposure of AD FS endpoints to only required federation protocols and client networks where possible.
Confirm that Web Application Proxy servers front all internet-facing AD FS traffic and are patched to the same build level.

Patch Information

Microsoft has issued updates for affected Windows Server versions hosting the AD FS role. Consult the Microsoft Security Update Guide for the specific KB articles, build numbers, and supported configurations. Apply updates to WAP servers first, then AD FS farm nodes in a rolling fashion to preserve availability.

Workarounds

Enable extranet smart lockout and configure AD FS request throttling at the Web Application Proxy to cap requests per source IP.
Place a rate-limiting reverse proxy, WAF, or load balancer rule in front of AD FS to drop abusive request patterns.
Where feasible, migrate federated applications to Microsoft Entra ID to reduce dependence on on-premises AD FS.

bash

# Example: cap concurrent connections per client IP at the WAP/IIS layer
# Requires the IIS Dynamic IP Restrictions module
Appcmd.exe set config -section:system.webServer/security/dynamicIpSecurity /denyByConcurrentRequests.enabled:"True" /denyByConcurrentRequests.maxConcurrentRequests:"20" /commit:apphost

# Example: enable AD FS extranet smart lockout
Set-AdfsProperties -ExtranetLockoutMode AdfsSmartLockoutEnforce -ExtranetLockoutThreshold 10 -ExtranetObservationWindow (New-TimeSpan -Minutes 10)