Loading vulnerability…
Unauthenticated Spoofing in Microsoft Active Directory Federation Services
CVE-2026-108131 is a network-accessible spoofing vulnerability in Microsoft Active Directory Federation Services (AD FS). An unauthenticated attacker can exploit it without user interaction to perform identity spoofing, potentially impersonating trusted users or services in federated authentication workflows. The vulnerability has a CVSS 3.1 score of 7.5, reflecting low attack complexity and high integrity impact. The vulnerable function and underlying implementation defect have not been specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the integrity of AD FS authentication and trust decisions. Identity spoofing could allow an attacker to impersonate trusted users or services to relying federated applications. The CVSS assessment identifies no direct confidentiality or availability impact; arbitrary code execution, full server control, and domain-wide compromise are not established consequences.
If you can’t patch tonight, do this now.
No vulnerability-specific alternative mitigation is identified. As defense in depth while updates are deployed, restrict network access to AD FS endpoints, avoid unnecessary direct Internet exposure, and use Web Application Proxy or an equivalent intermediary where appropriate; an intermediary alone is not an established workaround. Enable AD FS auditing and investigate anomalous token issuance, unexpected privileged-account authentication, and unauthorized federation-trust or token-signing certificate changes.
Patch, then assume compromise.
Apply the applicable Microsoft security update addressing CVE-2026-108131, identified as released in the October 13, 2026 update cycle. Confirm affected products and update applicability through Microsoft's Security Update Guide rather than relying on unverified build or KB mappings. Prioritize externally accessible AD FS deployments, restart where required, and verify successful update installation across affected servers.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.