Microsoft AD FS Has Critical Spoofing Flaw CVE-2026-96252
A critical vulnerability in Active Directory Federation Services allows remote spoofing due to improper cryptographic signature verification.
Key points
- CVE-2026-96252 is rated 9.1 Critical by the NVD.
- The flaw involves improper verification of cryptographic signatures.
- An unauthorized attacker can perform spoofing over a network.
Microsoft has identified a critical security flaw in its Active Directory Federation Services (AD FS) product that allows for network-based spoofing. The vulnerability, tracked as CVE-2026-96252, stems from improper verification of cryptographic signatures within the service.
According to the Microsoft Security Update Guide, this issue permits an unauthorized attacker to perform spoofing over a network. The National Vulnerability Database (NVD) has assigned the flaw a CVSS score of 9.1, categorizing it as Critical severity. The weakness is mapped to CWE-347, which denotes improper verification of cryptographic signatures.
Technical Details and Severity
The core issue lies in how AD FS handles cryptographic signature verification. The Microsoft advisory states that improper verification in this process allows for the spoofing action. The NVD record confirms the high severity rating of 9.1, indicating significant potential impact for systems running this component.
The description from both Microsoft and the NVD remains consistent regarding the nature of the attack. It specifies that an unauthorized attacker can exploit the flaw to perform spoofing. This capability exists over a network, meaning the attacker does not necessarily need local physical access to the compromised system to initiate the activity.
Affected Systems and Scope
The vulnerability specifically affects Active Directory Federation Services. This component is part of Microsoft's identity and access management infrastructure. The advisory from Microsoft links directly to the CVE-2026-96252 entry in their update guide, confirming the product scope.
No specific version numbers or release dates for affected or patched versions are provided in the current source material. The NVD record also does not list specific affected versions or CPE identifiers in the provided text. Organizations relying on AD FS for federation should assume exposure until further details are released.
What should you do?
Security teams should verify their inventory of Active Directory Federation Services deployments. Check for any recent changes in authentication logs that might indicate spoofing attempts. Monitor network traffic for anomalies related to identity validation. Prepare to apply updates as soon as Microsoft releases a confirmed fix.
What to do and how to stay safe: Microsoft
- Audit your environment to identify all servers running Active Directory Federation Services.
- Review authentication logs for signs of spoofing or invalid cryptographic signature errors.
- Monitor network traffic for unusual patterns associated with identity federation requests.
- Watch for official patch releases from Microsoft to remediate CVE-2026-96252.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-96252?
The National Vulnerability Database rates CVE-2026-96252 as 9.1, which is Critical severity.
What type of weakness causes this vulnerability?
The flaw is caused by improper verification of cryptographic signatures, classified as CWE-347.
How can an attacker exploit this flaw?
An unauthorized attacker can perform spoofing over a network according to the advisory.
