CVE-2026-108131

CVE-2026-108131 is a network spoofing flaw (CWE-290, authentication bypass by spoofing) in Microsoft Active Directory Federation Services. An unauthorized remote attacker can trigger it over the network with no user interaction and no prior privileges. Successful exploitation affects integrity only (CVSS 3.1 base score 7.5: high integrity impact, no confidentiality or availability impact), allowing the attacker to spoof identity or authentication rather than run code or crash the service. Organizations that run AD FS for federated sign-in are affected; exact product versions are not stated in the advisory data and are those fixed in Microsoft's October 2026 updates. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply Microsoft's October 2026 security updates for Active Directory Federation Services and the Windows Server hosts that run it. Until those updates are in place, limit network access to AD FS (especially internet-facing federation endpoints), and review sign-in and federation logs for unexpected authentication or identity-spoofing activity.