CVE-2026-103576: Active Directory Federation Services (AD FS) Spoofing Vulnerability
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Other sources
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9376Patch KB5126651 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5761Patch KB5126655 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.9612Patch KB5126868 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33650Patch KB5126646
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker can be unauthorized and does not need prior privileges. Exploitation is performed over a network and requires user interaction.
Which products are identified as affected?
The affected software list includes Microsoft Active Directory Federation Services, Windows 10, and Windows Server 2016, 2019, 2022, and 2025.
How can I determine whether my environment may be affected?
Identify deployments of Active Directory Federation Services and inventory whether they run on the listed Windows products. The provided data does not include affected build numbers, configuration conditions, or detection guidance.