AI analysis
CVE-2026-103576 is an open-redirect flaw (CWE-601) in Microsoft Active Directory Federation Services that lets an unauthorized remote attacker send a user to an untrusted site. It is triggered over the network when a user follows a crafted AD FS URL; no prior privileges are required, but user interaction is required. Microsoft rates it medium (CVSS 3.1 base score 6.5) with high confidentiality impact and describes the outcome as spoofing, which can support phishing or exposure of sensitive data presented inside a trusted AD FS flow. Organizations that run AD FS are affected; exact product builds are not listed in the supplied data, and the issue is associated with the October 2026 Patch Tuesday updates. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Apply the October 2026 Microsoft security updates that address CVE-2026-103576 on every server running the AD FS role. Until those updates are installed, review AD FS and web logs for unexpected redirect destinations and warn users not to continue if an AD FS sign-in or federation flow sends them to an unfamiliar site.
Affected
| Microsoft Active Directory Federation Services (AD FS) | Versions addressed by the October 2026 security updates; specific builds or ranges were not included in the provided data |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.