Vulnerabilities
CVE-2026-108131: AD FS Spoofing Vulnerability Exposes Authentication Tokens
Microsoft disclosed CVE‑2026‑108131, a spoofing flaw in Active Directory Federation Services that lets attackers forge authentication tokens. The issue affects all AD FS deployments prior to the latest security update. Defenders should apply the patch, verify configuration, and enforce MFA.
What happened
Microsoft identified a flaw in AD FS that allows an attacker to forge authentication tokens and impersonate users or services. The vulnerability is triggered when the AD FS server accepts a crafted request that bypasses normal token validation.
Impact
Any organization running AD FS before the latest update is vulnerable. Successful exploitation could lead to unauthorized access to protected resources, privilege escalation, and lateral movement within the network.
Mitigation
- Install the latest AD FS security update (CVE‑2026‑108131) from the Microsoft Update Catalog.
- Verify that AD FS is configured to enforce strict token validation and reject unsigned tokens.
- Enable multi‑factor authentication for all AD FS‑based logins.
- Monitor authentication logs for anomalous token issuance or repeated failed validation attempts.
Additional Recommendations
Consider isolating AD FS servers behind a dedicated firewall and restricting inbound traffic to known management IPs.
Related vulnerabilities
Microsoft Office SharePoint Spoofing Vulnerability (CVE-2026-102864)
A cross‑site scripting flaw in SharePoint’s page generation lets authenticated attackers inject spoofed content, enabling social‑engineering attacks. Patching and tightening permissions are critical.
Read briefing
SAP Exposes Critical Kernel & Message Server Flaws: CVE-2026-44756 & CVE-2026-58240
SAP’s September Security Patch Day revealed two critical vulnerabilities that can be exploited remotely without authentication. The memory‑corruption flaw in SAP Extended Passport (OVERPASS, CVE‑2026‑44756) and the missing‑auth bug in NetWeaver Message Server (S4GET, CVE‑2026‑58240) both allow attackers to run arbitrary OS commands as the SAP installation user, risking full system takeover. Immediate application of SAP Security Notes 3747649 and 3759472 is mandatory.
Read briefing
Microsoft SharePoint Server Spoofing Vulnerability (CVE-2026-63516) Acknowledged
Microsoft has acknowledged a spoofing vulnerability in SharePoint Server (CVE-2026-63516). The issue could allow attackers to impersonate legitimate users or services. Defenders should verify if their SharePoint deployments are affected and apply any forthcoming patches or mitigations.
Read briefing
Azure Portal XSS Spoofing Vulnerability (CVE-2026-83946) – Immediate Patch Required
A cross‑site scripting flaw in Azure Portal allows attackers to spoof the portal interface, potentially tricking users into submitting credentials or executing malicious actions. The vulnerability is exploitable without authentication and can be leveraged to perform phishing or credential theft. Defenders should apply the latest Azure updates and monitor for anomalous portal activity.
Read briefing