CVE-2026-85324: AD FS Memory Allocation DOS Vulnerability

CVE-2026-85324 Overview

CVE-2026-85324 is a denial-of-service vulnerability in Microsoft Active Directory Federation Services (AD FS). The flaw stems from memory allocation with an excessive size value [CWE-789], which an unauthenticated attacker can trigger over the network. Successful exploitation exhausts available memory on the AD FS server and disrupts federated authentication for dependent applications and services.

Critical Impact
An unauthenticated remote attacker can send crafted requests that force AD FS to allocate excessive memory, causing service outages that break single sign-on across federated applications.

Affected Products

Microsoft Active Directory Federation Services (AD FS)
Windows Server deployments hosting AD FS roles
Federated applications and relying parties dependent on AD FS for authentication

Discovery Timeline

2026-10-13 - CVE-2026-85324 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85324

Vulnerability Analysis

AD FS brokers federated authentication for Microsoft and third-party applications by issuing security tokens over standards such as WS-Federation, WS-Trust, and SAML. CVE-2026-85324 affects how the service processes attacker-controlled size values during request handling. When AD FS allocates memory based on an untrusted length field without enforcing an upper bound, a single malformed request can consume gigabytes of memory.

The condition maps to CWE-789: Memory Allocation with Excessive Size Value. The attack requires no authentication, no user interaction, and no elevated privileges. Impact is limited to availability; the vulnerability does not expose data or allow code execution.

Root Cause

The root cause is missing validation of a size parameter supplied in network input before it is passed to a memory allocation routine. The service trusts the declared length and attempts the allocation. Repeated or sufficiently large requests exhaust process or system memory, forcing AD FS worker processes to fail or restart.

Attack Vector

The attack vector is network-based and reaches AD FS endpoints exposed for federated sign-in. Public-facing AD FS deployments and Web Application Proxy front-ends are directly reachable from the internet. An attacker sends crafted protocol messages against endpoints such as /adfs/ls/, /adfs/services/trust, or /FederationMetadata/2007-06/FederationMetadata.xml to trigger the oversized allocation.

No verified public proof-of-concept code was available at the time of publication. See the Microsoft Security Update Guide for CVE-2026-85324 for Microsoft's technical details.

Detection Methods for CVE-2026-85324

Indicators of Compromise

Repeated AD FS worker process (Microsoft.IdentityServer.ServiceHost.exe) crashes or automatic restarts.
Sudden memory consumption spikes on AD FS or Web Application Proxy servers without a corresponding increase in legitimate sign-in volume.
Event Viewer entries under AD FS/Admin and AD FS/Debug showing allocation failures, worker process termination, or token issuance errors.
Elevated 5xx response rates and timeouts at /adfs/ls/ or /adfs/services/trust endpoints.

Detection Strategies

Baseline AD FS request volume, request size, and memory utilization, then alert on statistical deviations.
Inspect inbound AD FS traffic for oversized or malformed WS-Trust, WS-Federation, and SAML payloads.
Correlate AD FS service restarts with upstream network traffic from a limited set of source IPs.
Monitor failed federated authentication rates across relying parties as a secondary signal of AD FS unavailability.

Monitoring Recommendations

Forward AD FS admin, debug, and IIS logs to a central analytics platform for continuous review.
Enable AD FS verbose request logging during triage to capture payload sizes and client IPs.
Instrument availability monitoring against /adfs/ls/idpinitiatedsignon.aspx and the federation metadata endpoint from external vantage points.
Track process memory counters for the AD FS service and alert on sustained growth beyond baseline thresholds.

How to Mitigate CVE-2026-85324

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-85324 on all AD FS servers and Web Application Proxy servers.
Restrict exposure of AD FS endpoints to only the paths required for federated sign-in.
Place AD FS behind a Web Application Proxy or reverse proxy that enforces request size and rate limits.
Validate that AD FS farm redundancy is healthy so a single node failure does not cause a full outage.

Patch Information

Microsoft has issued fixes through the Security Update Guide. Refer to the Microsoft Vulnerability Update for CVE-2026-85324 for the specific KB articles, affected Windows Server builds, and installation guidance. Install the update on every AD FS node in the farm, then on Web Application Proxy servers, and verify federation functionality after each stage.

Workarounds

Enforce request size limits and rate limiting at the Web Application Proxy, load balancer, or upstream WAF for AD FS endpoints.
Block unauthenticated internet access to AD FS endpoints that are not required for external federation.
Enable AD FS Extranet Smart Lockout and connection throttling to reduce the volume of abusive requests reaching the service.
Where feasible, migrate relying parties to Microsoft Entra ID to reduce the AD FS attack surface.

bash

# Example: restrict AD FS request size at IIS on each AD FS server
# Adjust maxAllowedContentLength to a value appropriate for your tokens
%windir%\system32\inetsrv\appcmd.exe set config "Default Web Site/adfs" ^
  -section:system.webServer/security/requestFiltering ^
  /requestLimits.maxAllowedContentLength:65536 /commit:apphost

# Verify AD FS service health after applying changes
Get-Service adfssrv
Get-AdfsProperties | Select-Object HostName, ArtifactDbConnection