CVE-2026-97788
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
Risk Assessment
Risk of sensitive information leakage.
Recommendation
Install the latest Windows security updates.
Other vulnerabilities in Active Directory Federation Services
See all- CVE-2026-56155HighActively exploited
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-96222High
A vulnerability in Active Directory Federation Services (AD FS) related to improper certificate validation allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-83674High
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-83645High
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-83511High
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-70005Medium
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-69982Medium
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-108131High
A vulnerability in Active Directory Federation Services (AD FS) with no CWE assigned allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-103576Medium
URL redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. An attacker can lure a user to a malicious address.
- CVE-2026-72978Medium
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Original NVD description (English source)
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS