# Multiple Active Directory Federation Services (AD FS) Authentication Bypass and Spoofing Vulnerabilities (CVE-2026-69982, CVE-2026-96252, CVE-2026-108131)

> Microsoft's October 2026 Patch Tuesday fixed three network-reachable, unauthenticated flaws in Active Directory Federation Services: weak authentication (CVE-2026-69982, CVSS 5.9), improper cryptographic signature verification (CVE-2026-96252, CVSS 9.1) and authentication bypass by spoofing (CVE-2026-108131, CVSS 7.5). Patches are available and no active exploitation has been reported.

- **Published:** 2026-10-15T04:12:27Z
- **Last reviewed:** 2026-10-15T04:12:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3584
- **ID:** TL-2026-3584
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-69982, CVE-2026-96252, CVE-2026-108131

## Description

Three vulnerabilities in Active Directory Federation Services (AD FS) were published on 2026-10-13 as part of Microsoft's October 2026 Patch Tuesday and covered on 2026-10-15 by Cybersecurity News under the headline 'Multiple Active Directory Vulnerabilities Let Attackers Bypass Security Feature Remotely'. The news article describes them generically as Active Directory security feature bypass flaws; NVD data identifies the affected component as AD FS and classifies the issues as follows.

CVE-2026-69982 is a weak-authentication flaw (CWE-1390) that lets an unauthorized network attacker bypass a security feature in AD FS. NVD scores it 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). CVE-2026-96252 is an improper verification of a cryptographic signature (CWE-347) that allows an unauthorized attacker to perform spoofing over a network. NVD scores it 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2026-108131 is an authentication bypass by spoofing (CWE-290) in AD FS that allows an unauthorized attacker to perform spoofing over a network. NVD scores it 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

The affected-platform lists in NVD cover Windows 10 1607 and 1809, Windows Server 2012 R2, 2016, 2019, 2022 and 2025 (CVE-2026-108131 additionally lists Windows 10 21H2/22H2 and Windows 11 23H2 through 26H2). CrowdStrike's Patch Tuesday analysis notes that spoofing flaws in the federation service can enable token forgery or authentication bypass that propagates to every relying-party application trusting AD FS, and that organizations fully migrated to cloud-native identity are not exposed. Defenders should therefore treat on-premises AD FS servers (hybrid identity, partner federation) as the priority patching scope.

The sources reviewed do not report active exploitation, a public proof of concept, attributed threat actors or network/file IOCs. One secondary source states CVE-2026-108131 was not publicly disclosed and has unproven exploit code maturity. The MSRC advisory pages could not be rendered by the fetch tool, so KB numbers and fixed build numbers are not recorded here. A related but separate AD FS spoofing flaw, CVE-2026-96222 (improper certificate validation, CVSS 7.4), was patched in the same release and is not part of this threat record.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1606.002 SAML Tokens
- T1550.001 Application Access Token
- T1550.001 Application Access Token
- T1556 Modify Authentication Process
- T1212 Exploitation for Credential Access
- T1078 Valid Accounts

## Sources

- [Multiple Active Directory Vulnerabilities Let Attackers Bypass Security Feature Remotely](https://cybersecuritynews.com/multiple-active-directory-vulnerabilities/)
- [MSRC CVE-2026-69982](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69982)
- [MSRC CVE-2026-96252](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96252)
- [MSRC CVE-2026-108131](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108131)
- [NVD CVE-2026-69982](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-69982)
- [NVD CVE-2026-96252](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-96252)
- [NVD CVE-2026-108131](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-108131)
- [CrowdStrike: October 2026 Patch Tuesday Analysis](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-october-2026/)
- [Talos: Microsoft Patch Tuesday for October 2026 - Snort rules and prominent vulnerabilities](https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3584