AI analysis
CVE-2026-85319 is a high-severity denial-of-service flaw in Microsoft Active Directory Federation Services caused by allocation of resources without limits or throttling (CWE-770). An unauthorized attacker on the network can trigger the condition without credentials or user interaction and exhaust resources so that AD FS becomes unavailable. There is no confidentiality or integrity impact; availability of the federation service is the affected property (CVSS 3.1 base score 7.5). Organizations that publish AD FS for single sign-on and hybrid identity are the population at risk. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Apply Microsoft's October 2026 security updates for the Windows Server / AD FS role as soon as they are available for your build. Until then, limit network access to AD FS to required clients and identity partners, place it behind existing rate limiting or a reverse proxy, and alert on sudden CPU, memory, or request spikes against federation endpoints.
Affected
| Microsoft Active Directory Federation Services (AD FS) | — |
Estimated exposure
large≈10,000–50,000 internet-facing AD FS servers — Estimate only: AD FS is an optional enterprise federation role, commonly published for hybrid identity, and public scans have historically found on the order of tens of thousands of internet-reachable AD FS endpoints rather than a default…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.