Loading vulnerability…
SAML Signature Verification Bypass in Microsoft AD FS
CVE-2026-96252 is an improper cryptographic signature verification vulnerability in Microsoft Active Directory Federation Services (AD FS). An unauthenticated network attacker can relay a validly signed SAML response intended for a different endpoint to an affected AD FS endpoint, creating an unauthorized session and obtaining authentication tokens without user interaction. Microsoft rates the vulnerability Important, with a CVSS v3.1 base score of 9.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables identity spoofing and unauthorized access through AD FS sessions and issued tokens. The CVSS assessment indicates high confidentiality and integrity impact, with no availability impact. The extent of downstream access depends on the accepted identity claims and the permissions granted by federated applications; server compromise and arbitrary code execution are not established.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is identified. Restrict network access to AD FS endpoints to necessary clients and services where operationally feasible, and monitor suspicious federation authentication and token issuance activity. These defense-in-depth measures do not replace the security update.
Patch, then assume compromise.
Apply the Microsoft security update applicable to CVE-2026-96252 on affected AD FS systems. Consult Microsoft's Security Update Guide to identify affected products, the appropriate update packages, and installation requirements, then verify successful deployment. Specific fixed versions and update package identifiers are not available in the supplied information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.