Vulnerability/
CVE-2026-50324

CVE-2026-50324: Windows Active Directory Federation Services Denial of Service Vulnerability

Published Jul 14, 2026

·

Updated

Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

Other sources

Windows Active Directory Federation Services Denial of Service Vulnerability

— Microsoft

Affected Software

42 affected componentsFixes available

Microsoft Windows 10=1809

10.0.17763.9020

Microsoft Windows Server 2012 R2<6.3.9600.23291

6.3.9600.23291

Microsoft Windows Server 2016<10.0.14393.9339

10.0.14393.9339

Microsoft Windows Server 2012 R2<6.3.9600.23291

6.3.9600.23291

Microsoft Windows Server 2019<10.0.17763.9020

10.0.17763.9020

Microsoft Windows 10=1809

10.0.17763.9020

Microsoft Windows Server 2025<10.0.26100.33158

10.0.26100.33158

Microsoft Windows Server 2016<10.0.14393.9339

10.0.14393.9339

Microsoft Windows 10=1607

10.0.14393.9339

Microsoft Windows 10=1607

10.0.14393.9339

Microsoft Windows Server 2025<10.0.26100.33158

10.0.26100.33158

Microsoft Windows Server 2022<10.0.20348.5386

10.0.20348.5386

Microsoft Windows Server 2019<10.0.17763.9020

10.0.17763.9020

Microsoft .NET Framework=3.5

2.0.50727.8983 & 3.0.30729.8978

Microsoft .NET Framework=3.5

2.0.50727.8983 & 3.0.30729.8978

Microsoft .NET Framework=3.5, =4.8.1

2.0.50727.9182 & 3.0.30729.9168

Microsoft .NET Framework=3.5, =4.8.1

2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

Microsoft .NET Framework=3.5, =4.8.1

2.0.50727.9182 & 3.0.30729.9168 & 4.8.9340.0

Microsoft .NET Framework=3.5, =4.8.1

2.0.50727.9182 & 3.0.30729.9168 & 4.8.9340.0

Microsoft .NET Framework=3.5, =4.8.1

2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

Microsoft .NET Framework=3.5, =4.8.1

2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

Microsoft .NET Framework=4.6.2, =4.7, =4.7.1, =4.7.2

4.7.4143.0

Microsoft .NET Framework=3.5, =4.7.2

2.0.50727.8983 & 3.0.30729.8978 & 4.7.4143.0

Microsoft .NET Framework=4.6.2, =4.7, =4.7.1, =4.7.2

4.7.4143.0

Microsoft .NET Framework=3.5, =4.7.2

2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0

Microsoft .NET Framework=3.5, =4.8

2.0.50727.9182 & 3.0.30729.9168 & 4.8.4803.0

Microsoft .NET Framework=3.5, =4.8

2.0.50727.9182 & 3.0.30729.9168 & 4.8.4803.0

Microsoft .NET Framework=3.5, =4.8

2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0

Microsoft .NET Framework=4.8

4.8.4803.0

Microsoft .NET Framework=4.8

4.8.4803.0

Microsoft .NET Framework=4.8

4.8.4803.0

Microsoft Windows 10 1607<10.0.14393.9339

Microsoft Windows 10 1607<10.0.14393.9339

Microsoft Windows 10 1809<10.0.17763.9020

Microsoft Windows 10 1809<10.0.17763.9020

Microsoft Windows Server 2012

Microsoft Windows Server 2012=r2

Microsoft Windows Server 2016<10.0.14393.9339

Microsoft Windows Server 2019<10.0.17763.9020

Microsoft Windows Server 2022<10.0.20348.5386

Microsoft Windows Server 2025<10.0.26100.33158

Microsoft .NET Framework=4.8.1

4.8.9340.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9020Patch KB5099538
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.23291Patch KB5099444
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.9339Patch KB5099535
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33158Patch KB5099536
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5386Patch KB5099540
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.8983 & 3.0.30729.8978Patch KB5100984
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.8983 & 3.0.30729.8978Patch KB5100985
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9182 & 3.0.30729.9168Patch KB5101014
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0Patch KB5101004
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9340.0Patch KB5101003
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9340.0Patch KB5100998
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0Patch KB5101001
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0Patch KB5101000
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0Patch KB5101005
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.4143.0Patch KB5100991
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.8983 & 3.0.30729.8978 & 4.7.4143.0Patch KB5099535
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.4143.0Patch KB5100990
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0Patch KB5100989
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9182 & 3.0.30729.9168 & 4.8.4803.0Patch KB5101006
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9182 & 3.0.30729.9168 & 4.8.4803.0Patch KB5101010
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0Patch KB5101008
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4803.0Patch KB5101011
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4803.0Patch KB5101009
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4803.0Patch KB5101007
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.9340.0Patch KB5101002

Event History

Jul 14, 2026

CVE Published

via Microsoft·02:00 PM

Data Sourced

via Microsoft·02:00 PM

DescriptionSeverityWeaknessAffected Software

Updated

via Microsoft·02:00 PM

Affected Software

Updated

via Microsoft·02:00 PM

Description

CVE Published

via MITRE·05:06 PM

Data Sourced

via MITRE·05:06 PM

DescriptionSeverity

Data Sourced

via NVD·06:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-50324?

CVE-2026-50324 has a medium severity rating of 5.9.

2

What does CVE-2026-50324 do?

CVE-2026-50324 allows an unauthorized attacker to perform a denial of service attack on Windows Active Directory Federation Services.

3

Which software is affected by CVE-2026-50324?

CVE-2026-50324 affects various versions of Microsoft Windows Server and Windows 10, including Microsoft .NET Framework.

4

How do I fix CVE-2026-50324?

To mitigate CVE-2026-50324, users should apply the latest security updates provided by Microsoft.

5

What is the exploitability of CVE-2026-50324?

CVE-2026-50324 has an attack vector of network and can be exploited without authentication.

CVSS Score

5.9Medium

Medium Severity

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Security Metrics

Risk Score35

Severitymedium(5.9)

CWE

835

Timeline

PublishedJul 14, 2026

Updated

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50324Advisory

Tags

agent/titleagent/referencesagent/typeagent/risk-scorecollector/msrc-cvesource/Microsoftagent/weaknessagent/first-publish-dateagent/descriptionagent/sourceagent/severityagent/authorcollector/mitre-cvesource/MITREagent/eventagent/tagscollector/nvd-apisource/NVDagent/last-modified-datecollector/msrcagent/remedyagent/softwarecombinevendor/microsoftcanonical/microsoft windows 10version/microsoft windows 10/1809canonical/microsoft windows server 2012 r2canonical/microsoft windows server 2019canonical/microsoft windows server 2016version/microsoft windows 10/1607canonical/microsoft windows server 2025canonical/microsoft windows server 2022canonical/microsoft windows 10 1607canonical/microsoft windows 10 1809canonical/microsoft windows server 2012version/microsoft windows server 2012/r2canonical/microsoft .net frameworkversion/microsoft .net framework/3.5version/microsoft .net framework/4.8.1version/microsoft .net framework/4.6.2version/microsoft .net framework/4.7version/microsoft .net framework/4.7.1version/microsoft .net framework/4.7.2version/microsoft .net framework/4.8

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203