AI analysis
CVE-2026-69982 is a weak-authentication flaw (CWE-1390) in Microsoft Active Directory Federation Services that lets an unauthorized attacker bypass a security feature over the network. The issue is remotely reachable with no privileges and no user interaction, but exploitation complexity is high; successful abuse is scored as a high integrity impact with no confidentiality or availability impact. It affects organizations running AD FS, especially servers exposed to untrusted networks. Microsoft assigned the CVE (CVSS 3.1 base score 5.9, medium) and it was covered with the October 2026 Patch Tuesday AD fixes. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 Patch Tuesday updates for every Windows Server host running the AD FS role, starting with servers reachable from the internet. Until patching is complete, restrict network access to AD FS endpoints and review federation and authentication logs for unexpected unauthenticated access or security-feature bypasses. No public exploit is known, but treat internet-facing AD FS as higher priority.
Affected
| Microsoft Active Directory Federation Services (AD FS) | — |
Estimated exposure
largeTens of thousands of internet-reachable AD FS servers, plus additional internal-only deployments — Order-of-magnitude estimate from AD FS being a common on-premises federation role in Microsoft enterprise environments and from historical public internet scans that typically find on the order of tens of thousands of reachable AD FS…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.