An unauthorized attacker can exploit a flaw in Active Directory Federation Services (AD FS) to spoof another client over a network. The vulnerability allows the attacker to impersonate legitimate clients, compromising the integrity of authentication exchanges and potentially bypassing trust mechanisms. The issue aligns with CWE‑290 and CWE‑295, indicating a failure of authentication back‑channels or misrepresentation of credentials.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2); Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1); Microsoft Windows Server 2012 and 2012 R2 (including Server Core installations); Microsoft Windows Server 2016, 2019, 2022, and 2025 (including Server Core configurations).

The CVSS score of 7.5 classifies the flaw as high severity, but the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need network access to the AD FS service to attempt spoofing; no public exploit has been documented. In environments where AD FS is exposed to untrusted networks, the presence of the flaw could still allow an attacker to impersonate clients, but the overall likelihood of successful exploitation remains low based on the EPSS data.