AI analysis
CVE-2026-83645 is an unauthenticated denial-of-service flaw in Microsoft Active Directory Federation Services caused by allocation of resources without limits or throttling (CWE-770). A remote attacker can trigger it over the network with no privileges and no user interaction, exhausting resources so the service becomes unavailable. The impact is limited to availability; confidentiality and integrity are not affected, and the CVSS 3.1 base score is 7.5 (high). Organizations running AD FS for identity federation are affected; specific product versions are not listed in the provided data. It is not in CISA KEV, no public proof-of-concept is known, and it was covered in October 2026 Patch Tuesday reporting.
What to do: Apply Microsoft's October 2026 Patch Tuesday updates for the Windows Server / AD FS builds in your environment as soon as they are available. Until patched, restrict network access to AD FS endpoints to required clients and identity partners, and watch for resource exhaustion or service unavailability.
Affected
| Microsoft Active Directory Federation Services (AD FS) | — |
Estimated exposure
moderateOn the order of thousands to low tens of thousands of internet-facing AD FS servers (estimate) — AD FS is a common enterprise federation service rather than a mass consumer product; internet-facing instances are typically one or a few per organization, so exposure is estimated in the thousands to low tens of thousands of servers from…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.