IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft AD FS: Open redirect enables spoofing

CVE-2026-103576Medium 6.5

← All vulnerabilities

Summary

Active Directory Federation Services (AD FS) contains an open redirect (CWE-601). An unauthenticated remote attacker can send a victim a crafted link that redirects the sign-in flow to an untrusted site, which enables spoofing. The victim must interact, for example by clicking the link. The CNA record rates impact as high confidentiality, with no integrity or availability impact.

Affected

  • Windows Server 2016 and Server 2016 (Server Core): 10.0.14393.0 before 10.0.14393.9612
  • Windows Server 2019 and Server 2019 (Server Core): 10.0.17763.0 before 10.0.17763.9376
  • Windows Server 2022: 10.0.20348.0 before 10.0.20348.5761
  • Windows Server 2025 and Server 2025 (Server Core): 10.0.26100.0 before 10.0.26100.33650
  • Windows 10 Version 1607: 10.0.14393.0 before 10.0.14393.9612 (listed in the NVD CPE; unusual for AD FS)
  • Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9376 (listed in the CNA data; unusual for AD FS)

Fixed in

  • Windows Server 2016/2019 and Windows 10 1607/1809: October 13, 2026 security update (builds 10.0.14393.9612 and 10.0.17763.9376 or later)
  • Windows Server 2022 and 2025: build 10.0.20348.5761 or 10.0.26100.33650 or later
  • Verify the KB mapping for each product in the MSRC Security Update Guide.

Workaround

  • Unknown. No vendor workaround was found in the sources.
  • Not needed if the October 2026 update is applied.

Exploitation

  • No evidence of exploitation in the wild found. Not listed in CISA KEV in the sources.
  • No public proof of concept found.
  • CISA SSVC: exploitation none, automatable no, technical impact partial.
  • Microsoft temporal metrics: exploit code maturity Unproven, remediation level Official Fix.
  • EPSS about 0.8% (late October 2026).

Our recommendation

  • Apply the October 2026 security update to all AD FS servers within the normal patch window. No emergency change is needed based on current information.
  • Confirm which hosts run the AD FS role. Internet-facing AD FS sign-in pages carry the highest risk.
  • Check whether any Windows 10 1607 or 1809 hosts are still in use. These builds are out of mainstream support; verify their support status.
  • Warn users to be cautious with unexpected sign-in links and monitor AD FS logs for unusual redirects.
  • Verify the affected product list in the MSRC advisory, because the sources differ.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Spoofing – Active Directory Federation Services (AD FS)
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows
Updates (KB)
KB5126868, KB5126651, KB5126655, KB5126646

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 11:32.

Original description (NVD)

Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed