CVE-2026-72978
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Risk Assessment
An attacker could overwhelm AD FS, causing unavailability of authentication and authorization services, potentially disrupting the entire organization.
Recommendation
Implement resource limits and throttling for AD FS and apply vendor security updates.
Other vulnerabilities in Active Directory Federation Services
See all- CVE-2026-56155HighActively exploited
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-97788High
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
- CVE-2026-96222High
A vulnerability in Active Directory Federation Services (AD FS) related to improper certificate validation allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-83674High
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-83645High
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-83511High
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-70005Medium
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-69982Medium
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-108131High
A vulnerability in Active Directory Federation Services (AD FS) with no CWE assigned allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-103576Medium
URL redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. An attacker can lure a user to a malicious address.
Original NVD description (English source)
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS