Active Directory Federation Services spoofing allows unauthorised network attackers to forge identity (CVE-2026-96252)

What happened

CVE-2026-96252 is an improper verification of cryptographic signature in Active Directory Federation Services (AD FS), recorded as CWE-347. Microsoft's advisory describes it as allowing an unauthorised attacker to perform spoofing over a network. The CVSS 3.1 vector rates the flaw 9.1 critical, with low attack complexity, no required privileges and no user interaction. The impact is high for confidentiality and integrity, and none for availability.

In practice, an attacker who can reach AD FS over the network may be able to present spoofed identity material that the service accepts because the cryptographic signature is not properly verified. AD FS sits in the identity path for federated authentication, so a successful spoof could let the attacker assume an identity or access protected resources. There is no CISA KEV entry for CVE-2026-96252.

Who is affected

Active Directory Federation Services on the following Windows platforms is affected:

• Windows Server 2012: 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.0 to before 6.3.9600.23470
• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.0 to before 10.0.17763.9376
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025: 10.0.26100.0 to before 10.0.26100.33650

Server Core installations of Windows Server 2012, 2012 R2, 2016 and 2019 are also affected.

What to do now

1. Apply Microsoft's October 2026 security update. The fixed builds are:

• Windows Server 2012: 6.2.9200.26434 — KB5126835
• Windows Server 2012 R2: 6.3.9600.23470 — KB5126836
• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 — KB5126868
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9376 — KB5126651
• Windows Server 2022: 10.0.20348.5761 — KB5126655
• Windows Server 2025: 10.0.26100.33650 — KB5126646

1. Where Microsoft lists a Server Core installation in the fixed builds, the build and KB match the corresponding Windows Server release.

1. Microsoft has not published a workaround for this vulnerability. If you cannot apply the update immediately, restrict network access to AD FS endpoints to the networks and identity providers that require them, and monitor federation and sign-in logs for unusual activity.

Beyond the patch

AD FS is central to identity federation, so a network-reachable spoofing flaw changes the trust boundary that other access controls rely on. Patch first, then review where AD FS is exposed—our Virtual CISO Services (vCISO) examines internet-facing services, and our Managed Detection & Response (MDR) watches identity-based attack paths. For supplier-managed Windows estates, our Supply Chain Defense & Third-Party Risk tracks software and patch cadence.