CVE-2026-96252: AD FS Authentication Bypass Vulnerability

CVE-2026-96252 Overview

CVE-2026-96252 is an improper verification of cryptographic signature vulnerability [CWE-347] in Microsoft Active Directory Federation Services (AD FS). An unauthenticated attacker can exploit the flaw over the network to perform spoofing against federated authentication flows. The weakness enables forged tokens or assertions to pass signature validation, undermining trust in AD FS-issued security tokens.

Successful exploitation lets an attacker impersonate users or services that rely on AD FS for federated single sign-on. The vulnerability requires no privileges and no user interaction, and it affects the confidentiality and integrity of authenticated sessions downstream of AD FS.

Critical Impact

Attackers can forge signed authentication artifacts and spoof identities across any application federated through AD FS.

Affected Products

• Microsoft Active Directory Federation Services (AD FS)
• Windows Server deployments hosting the AD FS role
• Applications and services relying on AD FS-issued SAML or OAuth tokens

Discovery Timeline

• 2026-10-13 - CVE-2026-96252 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-96252

Vulnerability Analysis

The vulnerability resides in how AD FS validates cryptographic signatures on authentication artifacts. AD FS issues and consumes signed security tokens, typically SAML assertions or OAuth/OIDC tokens, which relying parties trust based on signature verification. When signature verification is incomplete or incorrectly implemented, an attacker can craft tokens that AD FS or federated applications accept as legitimate.

Because the attack is network-reachable and requires no authentication or user interaction, any exposed AD FS endpoint is reachable from untrusted networks when published to the internet. Successful exploitation permits identity spoofing against downstream relying parties, including Microsoft 365, line-of-business web applications, and SaaS services configured for federation.

Spoofed identities can grant access to email, files, and administrative portals that trust AD FS tokens. Lateral movement into cloud tenants is a realistic post-exploitation outcome where federation extends to Entra ID.

Root Cause

The root cause is improper verification of cryptographic signature [CWE-347]. AD FS does not sufficiently validate the digital signature on inbound or federated authentication artifacts, allowing forged or altered tokens to be treated as authentic. See the Microsoft Security Update Guide for vendor technical specifics.

Attack Vector

The attack is executed remotely over the network against AD FS federation endpoints such as /adfs/ls/ and /adfs/services/trust. An attacker crafts a token with an invalid or substituted signature, submits it to AD FS or a relying party, and leverages the acceptance of that token to assume another identity. No credentials and no user interaction are required.

Technical details for exploitation have not been publicly released. Refer to the vendor advisory for implementation specifics.

Detection Methods for CVE-2026-96252

Indicators of Compromise

• Unexpected successful SAML or OAuth token issuance events in the AD FS audit log (Event IDs 299, 324, 403, 410, 411) without a corresponding user authentication event.
• Token requests from unusual source IP addresses or geographies targeting /adfs/ls/ or /adfs/services/trust/* endpoints.
• Sign-in logs in Entra ID or federated applications showing authentications attributed to users with no matching activity on their endpoints.

Detection Strategies

• Correlate AD FS token issuance events with upstream primary authentication to flag tokens issued without a legitimate credential exchange.
• Monitor for signature validation errors or exceptions in AD FS trace logs that could indicate probing or malformed signature attempts.
• Baseline relying-party sign-in behavior and alert on anomalous session creation that bypasses expected MFA or conditional access.

Monitoring Recommendations

• Forward AD FS Admin, Security, and Trace logs to a centralized SIEM for long-term retention and cross-source correlation.
• Enable Entra ID sign-in log ingestion to catch spoofed federated authentications surfacing in the cloud control plane.
• Monitor the AD FS token-signing certificate for unexpected use, export attempts, or rotation outside change windows.

How to Mitigate CVE-2026-96252

Immediate Actions Required

• Apply the Microsoft security update for CVE-2026-96252 to all AD FS servers in the farm, starting with the primary node.
• Restrict public exposure of AD FS endpoints behind a Web Application Proxy or reverse proxy with strict ingress filtering.
• Rotate the AD FS token-signing and token-decrypting certificates after patching, and invalidate active sessions where feasible.

Patch Information

Microsoft has released fixes through the Patch Tuesday channel. Consult the Microsoft Security Update Guide to identify the specific update applicable to each affected Windows Server version hosting AD FS, and deploy it across all federation servers and proxies.

Workarounds

• Limit AD FS endpoint reachability to known networks until patching completes, using network ACLs or a Web Application Proxy policy.
• Enforce Entra ID conditional access and MFA at the relying-party layer to add defense in depth against spoofed federated tokens.
• Consider migrating authentication from AD FS to Entra ID where feasible to reduce reliance on on-premises federation.