AI analysis
CVE-2026-83646 is an open-redirect flaw (CWE-601) in Microsoft Active Directory Federation Services that lets an already authorized, high-privilege attacker send a user to an untrusted site. It is triggered over the network when a victim follows a crafted redirect, so user interaction is required. Successful use can spoof a trusted AD FS sign-in flow and has low confidentiality and integrity impact, with no availability impact. It affects organizations running the AD FS role, which is used for enterprise federation and single sign-on. Microsoft rated it 4.8 (medium); it is not in CISA’s KEV catalog and no public proof-of-concept is known.
What to do: Install Microsoft’s October 2026 security updates that cover Active Directory Federation Services on every AD FS server and farm node, then confirm the role is running the patched build. Until patching is complete, restrict high-privilege AD FS administration and warn users not to follow unexpected sign-in redirects to unfamiliar sites.
Affected
| Microsoft Active Directory Federation Services (AD FS) | — |
Estimated exposure
largeon the order of 10,000–100,000 AD FS servers (estimate) — AD FS is an optional enterprise Windows Server role, typically deployed as a small farm per organization and often internet-facing for federation; no vendor install count or public scan total is in the source data, so this is a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.