The vulnerability arises from an allocation of resources without limits or throttling within Active Directory Federation Services (AD FS), enabling an attacker to exhaust system resources and force a denial of service. This weakness corresponds to CWE‑770 and can affect the confidentiality, integrity, and availability of authentication services provided by AD FS. Because an attacker can trigger it remotely, the potential impact is that legitimate authentication requests cannot be processed, disrupting user access to protected resources.

The affected products are Microsoft Windows 10 (starting with version 1607 and including 1809) and Microsoft Windows Server from 2012 through 2025, including core installations. These versions of AD FS contain the unbounded resource allocation flaw. Admins of environments running these operating systems with AD FS should verify that any installed patches cover this vulnerability.

The CVSS score of 7.5 indicates a high impact severity. The EPSS score is 1%, indicating a low but nonzero probability of exploitation; however, the vulnerability is publicly documented by Microsoft and disclosed to the public, which suggests that attackers could feasibly exploit it from a remote network connection. The issue is not listed in the CISA KEV catalog, but the absence does not preclude exploitation. An attacker would need network access to the AD FS endpoints and sufficient persistence to flood the service with resource‑heavy requests, as the flaw lacks any authentication checks for resource allocation limits. Teams should anticipate a potentially high‑volume denial of service attack until remediation is applied.