ADFS Crypto Signature Bug CVE-2026-96252 Enables Network Spoofing With 9.1 CVSS Score

Microsoft has identified a critical security vulnerability in its Active Directory Federation Services product. The flaw, tracked as CVE-2026-96252, allows unauthorized attackers to perform spoofing attacks over a network.

What happened

Microsoft’s Security Update Guide lists CVE-2026-96252 as a spoofing vulnerability within Active Directory Federation Services. The National Vulnerability Database assigns this issue a CVSS score of 9.1, classifying it as Critical. This high severity rating reflects the potential impact of the flaw on identity infrastructure.

The root cause is improper verification of cryptographic signatures. According to the NVD record, this weakness aligns with CWE-347. An attacker can exploit this failure to spoof identity information over a network connection. No specific version numbers are listed in the provided advisory as affected.

Why it matters

Identity providers are high-value targets for cybercriminals. A flaw that undermines cryptographic verification can compromise the trust chain for authentication. Spoofing allows an attacker to impersonate legitimate services or users. This can lead to unauthorized access to protected resources.

The network-accessible nature of the exploit increases the risk surface. Attackers do not need local access to trigger the vulnerability. This makes remote exploitation possible from external networks. Organizations relying on AD FS for single sign-on are directly exposed.

What to watch

• Monitor Microsoft security advisories for patch release details
• Check internal logs for unusual authentication patterns
• Review network traffic for signs of spoofing attempts
• Verify cryptographic signature validation processes in AD FS

Who needs to act first

Teams should prioritize systems exposed to untrusted networks. Isolate critical identity servers if possible until a fix is available. Test any mitigation steps in a non-production environment first. Ensure backup procedures are current before making changes. Communicate with security operations centers to enhance monitoring. Validate that logging is capturing detailed authentication events. Prepare incident response plans for potential compromise scenarios. Coordinate with vendors for latest guidance on exposure reduction.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Microsoft

• Inventory all systems running Active Directory Federation Services
• Check for unauthorized changes to cryptographic configurations
• Monitor network logs for anomalous authentication requests
• Wait for official vendor patches before applying updates

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-96252?

It is a critical spoofing vulnerability in Active Directory Federation Services caused by improper cryptographic signature verification.

How severe is this vulnerability?

The National Vulnerability Database rates it as Critical with a CVSS score of 9.1.

Can attackers exploit this remotely?

Yes, the advisory states that unauthorized attackers can perform spoofing over a network.