CVE-2026-83646: Active Directory Federation Services (AD FS) Spoofing Vulnerability
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Other sources
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.9612Patch KB5126868 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33650Patch KB5126646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5761Patch KB5126655 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9376Patch KB5126651
Event History
Frequently Asked Questions
Does exploitation require an attacker to be authenticated or a user to take action?
Yes. The attacker must be authorized, and exploitation requires user interaction. The attack can be carried out over the network with low attack complexity.
Which systems are identified as affected?
The affected software list includes Microsoft Windows 10 and Microsoft Windows Server 2016, 2019, 2022, and 2025 in AD FS deployments.
What is the expected security impact?
The issue enables spoofing through redirection to an untrusted site. The supplied metrics indicate low confidentiality and integrity impact, no availability impact, and an impact that can extend beyond the initially affected security authority.