CVE-2026-50684
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Improper neutralization of input during web page generation (cross-site scripting) in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
Risk Assessment
An attacker can inject malicious script into the AD FS page, potentially leading to session theft or user impersonation.
Recommendation
Install the security update from Microsoft for AD FS and apply Content-Security-Policy headers.
Other vulnerabilities in Active Directory Federation Services (AD FS)
See all- CVE-2026-96252Critical
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. An attacker could impersonate a trusted identity.
- CVE-2026-85324High
Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-85321High
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-85319High
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-83646Medium
An open redirect vulnerability exists in Active Directory Federation Services (AD FS), allowing redirection to an untrusted site. An authorized attacker can exploit this to perform spoofing over a network.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS