Active Directory Federation Services: Information disclosure via observable discrepancy

Summary

A discrepancy in Active Directory Federation Services (AD FS) lets an unauthenticated attacker on the network read sensitive information. The CVSS vector shows high confidentiality impact only, with no effect on integrity or availability. The affected component is unclear: the MSRC title names AD FS, while the CNA and NVD data list .NET Framework and Windows 10 1607 builds.

Affected

• Per the CNA record, Windows 10 Version 1607 below 10.0.14393.9612
• Windows 10 Version 1809 below 10.0.17763.9376
• Windows 10 Version 21H2 below 10.0.19044.7807
• Windows 10 Version 22H2 below 10.0.19045.7807
• Windows 11 Version 23H2 below 10.0.22631.7652
• Windows 11 Version 24H2 below 10.0.26100.9711
• Microsoft .NET Framework 3.5, 4.6.2 to 4.8.1 in several builds (see the CNA record for exact ranges)
• Exact affected component to be confirmed on the MSRC page

Fixed in

• Windows 10 Version 1607: 10.0.14393.9612 or later
• Windows 10 Version 1809: 10.0.17763.9376 or later
• Windows 10 Version 21H2 and 22H2: 10.0.19044.7807 and 10.0.19045.7807 or later
• Windows 11 Version 23H2: 10.0.22631.7652 or later
• Windows 11 Version 24H2: 10.0.26100.9711 or later
• .NET Framework 3.5 and 4.8.1: Microsoft cumulative update of October 13, 2026 (KB5127689 for Windows 10 21H2/22H2 according to a Microsoft Support article); the KB for Windows 10 1607 is unknown

Workaround

Unknown. No vendor workaround was found. Restricting network access to AD FS endpoints can reduce exposure until patching, but this is not a Microsoft recommendation.

Exploitation

• Publicly disclosed: no
• Exploited in the wild: no
• Microsoft exploitation rating: Less Likely
• Public exploit code: none listed
• CISA KEV: not listed
• CISA SSVC: exploitation none, automatable yes, technical impact partial
• EPSS: 0.88% as of 2026-10-16 (another snapshot shows 0.69%)

Our recommendation

• Check whether AD FS or the affected .NET Framework or Windows builds are in use, and whether they are reachable from the internet
• Install the October 2026 security updates on affected systems, prioritising internet-facing ones
• Verify the affected component and KB numbers on the MSRC page before patching
• Plan an upgrade of Windows 10 1607 systems, because patching may not be a long-term solution
• Restrict access to AD FS endpoints where patching is not yet possible
• Monitor AD FS logs for unusual authentication activity

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-97788 msrc.microsoft.com
• NVD mirror via Vulners: CVE-2026-97788 vulners.com
• Microsoft Support: October 13, 2026 .NET Framework update KB5127689 support.microsoft.com
• OpenCVE: CVE-2026-97788 app.opencve.io
• CVEdetails: Microsoft .NET Framework vulnerabilities www.cvedetails.com
• Strix: CVE-2026-97788 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:03.