CVE-2026-83646
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
An open redirect vulnerability exists in Active Directory Federation Services (AD FS), allowing redirection to an untrusted site. An authorized attacker can exploit this to perform spoofing over a network.
Risk Assessment
Attackers could redirect users to malicious sites, potentially leading to credential theft or malware distribution in organizations using AD FS.
Recommendation
Apply available security updates for AD FS as soon as possible and implement URL validation for redirects to mitigate the risk.
Other vulnerabilities in Active Directory Federation Services (AD FS)
See all- CVE-2026-96252Critical
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. An attacker could impersonate a trusted identity.
- CVE-2026-85324High
Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-85321High
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-85319High
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-50684Medium
Improper neutralization of input during web page generation (cross-site scripting) in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
Original NVD description (English source)
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS