Active Directory Federation Services: Spoofing due to weak authentication

Summary

Microsoft Active Directory Federation Services (AD FS) contains a spoofing vulnerability caused by weak authentication. An unauthorized attacker on the network can perform spoofing, and the attack requires no privileges or user interaction, although Microsoft rates attack complexity as high. Exposure is greatest where the AD FS endpoint is reachable from the internet, because AD FS provides single sign-on for other applications. Microsoft's October 13, 2026 security updates fix the issue.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9612
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9376
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650
• The NVD CPE lists only Windows 10 1607, so the CNA record is the authoritative list.

Fixed in

• Windows 10 Version 1607 x64: KB5126868 (build 14393.9612)
• Windows 10 Version 1607 32-bit: KB number not confirmed; the MSRC page lists 5126655, so verify on MSRC before rollout
• Windows 10 1809 and Windows Server 2016, 2019, 2022, 2025: October 2026 security updates for the builds listed above; confirm the KB numbers on MSRC

Workaround

Unknown. No workaround is documented by Microsoft.

• If patching is delayed, restrict network access to AD FS endpoints (general recommendation, not a documented Microsoft mitigation).

Exploitation

• Not listed in CISA KEV.
• CISA SSVC data: exploitation none, automatable no.
• Microsoft rates exploit code maturity as Unproven.
• EPSS is about 0.7%.
• No public proof-of-concept known at the time of research.

Our recommendation

• Identify all AD FS servers and proxies, including Windows Server 2016 to 2025 and any Windows 10 1607 or 1809 hosts.
• Install the October 2026 updates, using the KB that matches each architecture on the MSRC page.
• Check whether AD FS is still in use and whether any endpoint is internet-facing; restrict access if it is not essential.
• Confirm the support status of Windows 10 1607 with Microsoft (updates end per Microsoft release health) and plan ESU or an upgrade.
• Patch together with the related same-day AD FS spoofing CVEs CVE-2026-83646 and CVE-2026-83511, and monitor for public PoC or KEV listings.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-83674 msrc.microsoft.com
• KB5126868 Windows 10 1607 security update support.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 learn.microsoft.com
• CNA data mirror (Vulners) vulners.com
• NVD mirror (Vulners) vulners.com
• OpenCVE CVE-2026-83674 app.opencve.io
• Strix CVE-2026-83674 www.strix.ai
• SonicWall: Microsoft October 2026 security bulletin coverage www.sonicwall.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:27.