Vulnerabilities
CVE-2026-96222: AD FS Spoofing Vulnerability – Immediate Patch Required
Microsoft disclosed CVE-2026-96222, a spoofing flaw in Active Directory Federation Services that allows attackers to forge authentication tokens and impersonate users. The vulnerability affects AD FS 2016, 2019, and 2022. Apply the latest security update immediately and verify token validation logic.
What Happened
Microsoft identified a flaw in AD FS that permits token spoofing, enabling attackers to forge authentication tokens and impersonate legitimate users without valid credentials.
Impact
Unauthenticated attackers can gain unauthorized access to any application or service that relies on AD FS for authentication, potentially escalating privileges and compromising sensitive data.
Affected Systems
- AD FS 2016
- AD FS 2019
- AD FS 2022
Mitigation
Apply the security update released on 2026-10-15 (KBxxxxxx). Verify that the AD FS service is running the patched version. Enforce multi‑factor authentication and monitor authentication logs for abnormal token patterns.
Recommended Actions
- Check patch status via WSUS or SCCM.
- Validate token signing certificates and configuration.
- Review AD FS settings for least privilege.
- Implement monitoring for token anomalies.
Related vulnerabilities
CVE-2026-105008: Windows Schannel Spoofing Vulnerability – Immediate Patch Required
A new spoofing flaw in Windows Schannel (CVE‑2026‑105008) can allow attackers to impersonate a TLS server, potentially enabling man‑in‑the‑middle attacks. The vulnerability affects all Windows systems that use the Schannel stack. Apply the latest security updates and verify TLS configurations immediately.
Read briefing
Azure Portal XSS Spoofing Vulnerability (CVE-2026-83946) – Immediate Patch Required
A cross‑site scripting flaw in Azure Portal allows attackers to spoof the portal interface, potentially tricking users into submitting credentials or executing malicious actions. The vulnerability is exploitable without authentication and can be leveraged to perform phishing or credential theft. Defenders should apply the latest Azure updates and monitor for anomalous portal activity.
Read briefing
Microsoft Office SharePoint SSRF Spoofing Vulnerability (CVE-2026-105713)
A server‑side request forgery flaw in Microsoft Office SharePoint can let an authenticated user spoof requests to adjacent networks. The issue is rated critical and affects all SharePoint deployments. Apply the latest patch and tighten network controls immediately.
Read briefing
CVE-2026-108131: AD FS Spoofing Vulnerability Exposes Authentication Tokens
Microsoft disclosed CVE‑2026‑108131, a spoofing flaw in Active Directory Federation Services that lets attackers forge authentication tokens. The issue affects all AD FS deployments prior to the latest security update. Defenders should apply the patch, verify configuration, and enforce MFA.
Read briefing