CVE-2026-50684

MediumCVSS 4.8

Published: 14/07/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

Improper neutralization of input during web page generation (cross-site scripting) in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.

Risk Assessment

An attacker can inject malicious script into the AD FS page, potentially leading to session theft or user impersonation.

Recommendation

Install the security update from Microsoft for AD FS and apply Content-Security-Policy headers.

Other vulnerabilities in Active Directory Federation Services (AD FS)

CVE-2026-96252Critical
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. An attacker could impersonate a trusted identity.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS