AI analysis
CVE-2026-70005 is a weak-authentication flaw (CWE-1390) in Microsoft Active Directory Federation Services that lets an unauthorized attacker bypass a security feature over the network. The issue is remotely reachable with no privileges and no user interaction, but CVSS rates attack complexity as high (CVSS 3.1 base score 5.9). A successful bypass affects integrity only (high); confidentiality and availability are not impacted. It affects organizations running AD FS; exact product versions are not listed in the advisory data and the issue is tied to October 2026 Patch Tuesday. It is not on the CISA KEV list, and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 Patch Tuesday security updates for the Windows Server systems that host AD FS, and confirm the updates are applied on every federation server and farm node. Until patched, limit network exposure of AD FS (especially internet-facing endpoints) to required identity partners and monitor authentication and security-feature bypass events. No fixed build numbers are given in the advisory data, so use Microsoft's October 2026 update guidance for the exact packages.
Affected
| Microsoft Active Directory Federation Services (AD FS) | — |
Estimated exposure
large≈10,000–100,000 internet-facing AD FS servers (estimate) — AD FS is an optional Windows Server role used for enterprise SSO and federation, so it is far narrower than all Windows installations; public deployment patterns imply on the order of tens of thousands of internet-reachable federation…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.