Loading vulnerability…
Authentication-Based Security Feature Bypass in Microsoft AD FS
CVE-2026-69982 is a weak authentication vulnerability in Microsoft Active Directory Federation Services (AD FS) that allows an unauthenticated attacker to bypass a security feature over a network. Exploitation requires no user interaction but has high complexity and depends on precise conditions that have not been specified. Microsoft rates the vulnerability Important, with a CVSS v3.1 base score of 5.9, and assesses exploitation as less likely. The specific security feature, vulnerable function, and affected software versions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses an AD FS security feature, with high integrity impact according to Microsoft's CVSS assessment. The assessment indicates no confidentiality or availability impact. The bypass does not establish full server control; additional consequences are not specified.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. General defense-in-depth measures include restricting network access to identity infrastructure to required hosts, separating administrative systems from user networks, requiring strong authentication for privileged accounts, and monitoring unusual authentication failures and unexpected privilege changes. These measures are not established substitutes for the security update.
Patch, then assume compromise.
Apply the applicable Microsoft security update to affected AD FS deployments. An official fix is available, but update package identifiers, KB numbers, and fixed versions are not specified. Consult Microsoft's Security Update Guide to determine applicable updates and verify successful installation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.