CVE-2026-96222
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A vulnerability in Active Directory Federation Services (AD FS) related to improper certificate validation allows an unauthorized attacker to perform spoofing over a network.
Risk Assessment
An attacker may impersonate a trusted entity, potentially leading to unauthorized access to systems and data.
Recommendation
Install the latest security updates for AD FS.
Other vulnerabilities in Active Directory Federation Services
See all- CVE-2026-56155HighActively exploited
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-97788High
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
- CVE-2026-83674High
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-83645High
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-83511High
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-70005Medium
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-69982Medium
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-108131High
A vulnerability in Active Directory Federation Services (AD FS) with no CWE assigned allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-103576Medium
URL redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. An attacker can lure a user to a malicious address.
- CVE-2026-72978Medium
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Original NVD description (English source)
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS