Threat reportVulnerabilityTL-2026-3584
Multiple Active Directory Federation Services (AD FS) Authentication Bypass and Spoofing Vulnerabilities (CVE-2026-69982, CVE-2026-96252, CVE-2026-108131)
Multiple Active Directory Federation Services (AD FS) (TL-2026-3584) is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-10-15. It has no confirmed attribution, affects Microsoft Active Directory Federation Services (AD FS) on Windows, references 3 CVEs (CVE-2026-69982, CVE-2026-96252, CVE-2026-108131), maps to 6 MITRE ATT&CK techniques (T1078, T1190, T1212), and is covered by 9 detection rules and 4 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 4Indicators of compromise
Key facts for TL-2026-3584
- Threat ID
- TL-2026-3584
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 4
How Multiple Active Directory Federation Services (AD FS) works
Microsoft's October 2026 Patch Tuesday fixed three network-reachable, unauthenticated flaws in Active Directory Federation Services: weak authentication (CVE-2026-69982, CVSS 5.9), improper cryptographic signature verification (CVE-2026-96252, CVSS 9.1) and authentication bypass by spoofing (CVE-2026-108131, CVSS 7.5). Patches are available and no active exploitation has been reported.
Three vulnerabilities in Active Directory Federation Services (AD FS) were published on 2026-10-13 as part of Microsoft's October 2026 Patch Tuesday and covered on 2026-10-15 by Cybersecurity News under the headline 'Multiple Active Directory Vulnerabilities Let Attackers Bypass Security Feature Remotely'. The news article describes them generically as Active Directory security feature bypass flaws; NVD data identifies the affected component as AD FS and classifies the issues as follows.
CVE-2026-69982 is a weak-authentication flaw (CWE-1390) that lets an unauthorized network attacker bypass a security feature in AD FS. NVD scores it 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). CVE-2026-96252 is an improper verification of a cryptographic signature (CWE-347) that allows an unauthorized attacker to perform spoofing over a network. NVD scores it 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2026-108131 is an authentication bypass by spoofing (CWE-290) in AD FS that allows an unauthorized attacker to perform spoofing over a network. NVD scores it 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
The affected-platform lists in NVD cover Windows 10 1607 and 1809, Windows Server 2012 R2, 2016, 2019, 2022 and 2025 (CVE-2026-108131 additionally lists Windows 10 21H2/22H2 and Windows 11 23H2 through 26H2). CrowdStrike's Patch Tuesday analysis notes that spoofing flaws in the federation service can enable token forgery or authentication bypass that propagates to every relying-party application trusting AD FS, and that organizations fully migrated to cloud-native identity are not exposed. Defenders should therefore treat on-premises AD FS servers (hybrid identity, partner federation) as the priority patching scope.
The sources reviewed do not report active exploitation, a public proof of concept, attributed threat actors or network/file IOCs. One secondary source states CVE-2026-108131 was not publicly disclosed and has unproven exploit code maturity. The MSRC advisory pages could not be rendered by the fetch tool, so KB numbers and fixed build numbers are not recorded here. A related but separate AD FS spoofing flaw, CVE-2026-96222 (improper certificate validation, CVSS 7.4), was patched in the same release and is not part of this threat record.
MITRE ATT&CK techniques used in TL-2026-3584
Defense Evasion
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1556 Modify Authentication Process; T1606.002 SAML Tokens
lateral-movement
T1550.001 Application Access Token
Lateral Movement
Affected products and versions in Multiple Active Directory Federation Services (AD FS)
- Microsoft — Active Directory Federation Services (AD FS) on Windows Server
Vulnerable versions: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025
Fixed in: Builds included in the 2026-10-13 cumulative updates (see MSRC) - Microsoft — Windows 10 / Windows 11 (AD FS related components)
Vulnerable versions: Windows 10 1607; Windows 10 1809; Windows 10 21H2; Windows 10 22H2; Windows 11 23H2; Windows 11 24H2; Windows 11 25H2
Fixed in: Builds included in the 2026-10-13 cumulative updates (see MSRC)
Remediation for Multiple Active Directory Federation Services (AD FS)
Patches
- Install the Windows cumulative updates released 2026-10-13 referenced in the MSRC Security Update Guide entries for CVE-2026-69982, CVE-2026-96252 and CVE-2026-108131
Immediate actions
- Apply the October 13, 2026 Microsoft cumulative security updates to all AD FS servers and federation proxies, including backup and DR farm members
- Inventory every on-premises AD FS farm and identify relying-party trusts that depend on it
- Monitor AD FS and domain controller logs for unusual authentication failures, unexpected token issuance and privilege changes
Workarounds
- No workaround published in reviewed sources; limit network access to AD FS endpoints until patched
Longer-term hardening
- Restrict network exposure of AD FS and directory services to required hosts only and enforce strong authentication
- Evaluate migrating from on-premises AD FS to cloud-native identity, which CrowdStrike notes is not affected
- Verify patch deployment through endpoint management tooling and test updates in a staging farm before production
CVEs associated with Multiple Active Directory Federation Services (AD FS)
Weaknesses (CWE) in Multiple Active Directory Federation Services (AD FS)
Timeline of Multiple Active Directory Federation Services (AD FS)
- A separate AD FS spoofing flaw, CVE-2026-96222 (improper certificate validation, CVSS 7.4), is patched in the same release and cited alongside CVE-2026-108131 by CrowdStrike and Talos
- CrowdStrike reports the October 2026 Patch Tuesday addressed 1,413 CVEs including 75 critical and three zero-days (one exploited, two publicly disclosed); the exploited zero-day is not one of the three AD FS CVEs in this record
- Patch Tuesday analyses (e.g., CrowdStrike) note AD FS spoofing flaws can enable token forgery affecting all relying parties
- Cisco Talos publishes Snort rule ranges for October 2026 Microsoft vulnerabilities, naming CVE-2026-108131 among the AD FS spoofing flaws
- NVD publishes CVE-2026-69982 (CVSS 5.9), CVE-2026-96252 (CVSS 9.1) and CVE-2026-108131 (CVSS 7.5)
- Microsoft releases fixes for the three AD FS vulnerabilities as part of October 2026 Patch Tuesday
- NVD last-modified date for CVE-2026-96252 (CVSS 9.1 Critical, CWE-347) is updated
- Cybersecurity News reports the Active Directory flaws as remotely exploitable security feature bypasses with patches available and no evidence of active exploitation
Sources cited for Multiple Active Directory Federation Services (AD FS)
- Multiple Active Directory Vulnerabilities Let Attackers Bypass Security Feature Remotely
- MSRC CVE-2026-69982
- MSRC CVE-2026-96252
- MSRC CVE-2026-108131
- NVD CVE-2026-69982
- NVD CVE-2026-96252
- NVD CVE-2026-108131
- CrowdStrike: October 2026 Patch Tuesday Analysis
- Talos: Microsoft Patch Tuesday for October 2026 - Snort rules and prominent vulnerabilities
Detection coverage for TL-2026-3584
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3584 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.