AI analysis
CVE-2026-96222 is an improper certificate validation flaw (CWE-295) in Microsoft Active Directory Federation Services. A remote, unauthenticated attacker who can meet a high-complexity network condition can cause AD FS to accept a certificate it should reject and thereby spoof a trusted party. Successful spoofing can expose sensitive identity data and let the attacker impersonate a federated user or partner, with high impact on confidentiality and integrity and no direct availability impact (CVSS 3.1 base score 7.4). Organizations running AD FS that have not applied the October 2026 Microsoft updates are affected. It is not listed in CISA KEV, and no public proof-of-concept was known at the time of this advisory data.
What to do: Install the October 2026 Patch Tuesday security updates that cover AD FS on every Windows Server running the role, then confirm federation trusts still validate partner certificates as expected. Until the patch is applied, restrict AD FS to trusted networks where possible and review recent token-issuance and trust changes for unexpected partners or certificates. No public proof-of-concept or CISA KEV listing was indicated.
Affected
| Microsoft Active Directory Federation Services (AD FS) | — |
Estimated exposure
largeon the order of tens of thousands of AD FS deployments — AD FS is an optional Windows Server role used mainly by organizations that federate identity for SSO; the advisory data did not include active-install counts, market share, or public scan totals, so the figure is a rough deployment-pattern…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.