AI analysis
CVE-2026-83674 is a weak-authentication flaw (CWE-1390) in Microsoft Active Directory Federation Services. An unauthorized attacker can trigger it over the network with no prior privileges and no user interaction, though Microsoft rates attack complexity as high, and the described result is spoofing. CVSS 3.1 scores it 8.1 (high), with high impact to confidentiality, integrity, and availability and unchanged scope. Organizations running AD FS are affected; specific builds are not listed in the supplied data, and the issue was published with the October 2026 Patch Tuesday updates. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates for every AD FS server in the farm as soon as they are available for your build, and confirm the patch level afterward. Until then, do not leave AD FS broadly reachable from the internet and review authentication and token-issuance logs for unexpected identities or issuers. No public exploit is known, but unpatched network-reachable servers should be treated as high priority because the flaw requires no credentials.
Affected
| Microsoft Active Directory Federation Services (AD FS) | — |
Estimated exposure
large≈10,000–100,000 internet-facing AD FS servers (order-of-magnitude estimate) — AD FS remains a common on-premises Microsoft federation front end, and public scans of exposed federation endpoints have historically been in the tens of thousands, so this is an order-of-magnitude estimate of reachable servers rather than…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.