AD FS Spoofing Flaw CVE-2026-96252 Threatens Identity Infrastructure

Active Directory Federation Services contains a flaw that permits network-based spoofing by failing to verify cryptographic signatures correctly. Microsoft’s official security advisory identifies this as CVE-2026-96252. The vulnerability allows an attacker to perform spoofing over a network, as stated in the official summary.

How does the flaw compromise AD FS?

The core issue lies in the improper verification of cryptographic signatures within Active Directory Federation Services. According to the Microsoft Security Update Guide, this lapse enables an unauthorized attacker to perform spoofing over a network. The source material does not specify the exact mechanism of the spoofing beyond the signature verification failure.

What is the severity rating?

The National Vulnerability Database assigns a CVSS score of 9.1 to CVE-2026-96252, classifying the vulnerability as critical. This high score reflects the significant risk associated with the improper handling of cryptographic data. The classification aligns with CWE-347, which denotes issues with improper verification of cryptographic signatures.

Who can exploit this vulnerability?

The Microsoft advisory specifies that an unauthorized attacker can leverage this flaw. The description notes that the attack occurs over a network. The source material does not specify whether prior access is required or if the attack is strictly remote, only that an unauthorized attacker can perform spoofing.

Is a fix available?

The provided source material does not confirm the release of a patch or update for CVE-2026-96252. Organizations should monitor official vendor channels for further guidance. The source material does not list specific affected versions, so the scope of impacted systems is not detailed in the advisory.

What analysts watch for

Security teams typically monitor for anomalous authentication requests that bypass standard validation flows. Analysts examine logs for unexpected signature failures or successful logins originating from unusual network segments. They check for signs of identity confusion where user contexts appear swapped or where tokens contain mismatched cryptographic claims. Reviewing federation trust settings and certificate chains for recent, unauthorized modifications is also standard practice to detect persistence or lateral movement attempts.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: Microsoft

• Review Active Directory Federation Services logs for patterns indicating successful spoofing or signature validation errors.
• Restrict network access to AD FS endpoints to known, trusted subnets to reduce the attack surface.
• Verify that all federation certificates and signing keys are intact and have not been tampered with.
• Prepare to apply the vendor's update once it is officially released and confirmed to address this specific CVE.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific component is affected by CVE-2026-96252?

The vulnerability affects Active Directory Federation Services (AD FS) due to improper verification of cryptographic signatures.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-96252 with a CVSS score of 9.1, which is classified as critical.

How can an attacker exploit this flaw?

An unauthorized attacker can perform spoofing over a network by exploiting the improper verification of cryptographic signatures.