{"id":"CVE-2026-96252","published":"2026-10-13T19:21:51.343","lastModified":"2026-10-14T04:18:59.063","description":"Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96252","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"AD FS fails to properly verify cryptographic signatures, allowing attackers to spoof identities and impersonate users or services over the network. This creates a critical authentication bypass vulnerability that can lead to unauthorized access to protected resources.","exploitability":"Exploitation requires network access to AD FS endpoints with minimal preconditions, making it relatively easy to execute against exposed AD FS servers.","blast_radius":"If exploited, this vulnerability could allow attackers to impersonate any user or service in the AD FS environment, potentially leading to full domain compromise and unauthorized access to sensitive corporate resources.","remediation":"Deploy the latest AD FS security update from Microsoft, specifically the July 2026 cumulative update for AD FS server role which contains the fix for CVE-2026-96252.","detection":"Monitor for failed authentication attempts with invalid signatures in AD FS server logs, particularly in the Security log under Event ID 41001 or 41002 which indicate signature validation failures.","tags":["adfs","authentication","spoofing","identity"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:56:52.328Z"}}