AI analysis
CVE-2026-85324 is a denial-of-service flaw in Microsoft Active Directory Federation Services caused by a memory allocation that uses an excessive size (CWE-789). An unauthorized attacker on the network can trigger it without credentials or user interaction. The impact is limited to availability: the service can be disrupted, with no confidentiality or integrity impact (CVSS 3.1 base score 7.5). Organizations that run AD FS, including servers exposed for external federation, are affected; exact version ranges are not stated in the CVE data and are covered by the October 2026 Patch Tuesday updates. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates for the Windows Server hosts that run AD FS as soon as they are available for your build. Until patched, limit network access to AD FS to required clients and federation partners and watch those servers for memory exhaustion or service crashes.
Affected
| Microsoft Active Directory Federation Services (AD FS) | — |
Estimated exposure
moderateon the order of thousands to low tens of thousands of internet-reachable AD FS servers — AD FS is an optional Windows Server role used by organizations for federation and single sign-on and is often published to the internet; public scan footprints are typically thousands to low tens of thousands of endpoints, not a mass…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.