CVE-2020-1055
MediumCVSS 5.5Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
A cross-site-scripting (XSS) vulnerability in Active Directory Federation Services (ADFS) due to improper sanitization of user inputs. An unauthenticated attacker can send a crafted request to an affected ADFS server, and upon successful exploitation, perform XSS attacks and run scripts in the current user's security context.
Risk Assessment
An attacker can execute scripts in the user's context, potentially leading to data theft or unauthorized actions.
Recommendation
Install the security update that ensures proper sanitization of user inputs in ADFS.
Other vulnerabilities in Active Directory Federation Services
See all- CVE-2026-56155HighActively exploited
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-58529High
An out-of-bounds read vulnerability in Active Directory Federation Services (AD FS) allows an authorized attacker to disclose information over a network.
- CVE-2026-50647High
An infinite loop in Active Directory Federation Services (AD FS) allows an unauthorized attacker to remotely cause a denial of service (DoS).
- CVE-2026-50411High
A stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-50368High
A stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
- CVE-2026-50355High
A stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to remotely cause a denial of service (DoS).
- CVE-2026-50324Medium
An infinite loop in Active Directory Federation Services (AD FS) allows an unauthorized attacker to cause a denial of service over the network.
- CVE-2026-50304High
Stack-based buffer overflow in Active Directory Federation Services (ADFS) allows an unauthorized attacker to perform a DoS attack over the network.
- CVE-2026-54983High
A stack-based buffer overflow vulnerability in Active Directory Federation Services (AD FS) allows an unauthorized attacker to remotely execute code or cause a denial of service (DoS) by sending a specially crafted network request.
- CVE-2026-50695High
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
Original NVD description (English source)
A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs. An un-authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected ADFS server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run scripts in the security context of the current user. This security update addresses the vulnerability by ensuring that ADFS properly sanitizes user inputs.