CVE-2026-103576: Active Directory Federation Services (AD FS) Spoofing Vulnerability
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Other sources
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker can be unauthorized and does not need prior privileges. Exploitation is performed over a network and requires user interaction.
Which products are identified as affected?
The affected software list includes Microsoft Active Directory Federation Services, Windows 10, and Windows Server 2016, 2019, 2022, and 2025.
How can I determine whether my environment may be affected?
Identify deployments of Active Directory Federation Services and inventory whether they run on the listed Windows products. The provided data does not include affected build numbers, configuration conditions, or detection guidance.