The vulnerability arises from weak authentication in Active Directory Federation Services, allowing an attacker who does not possess valid credentials to impersonate a trusted entity and perform spoofing across the network. This weakness can lead to unauthorized access, interception of communications, or manipulation of authentication processes, negatively affecting the confidentiality and integrity of services that rely on AD FS. The weakness is classified as CWE-1390, an example of improper authentication flaws.

Microsoft Windows 10 Version 1607 and 1809, Microsoft Windows Server 2016 (both standard and Server Core installations), Microsoft Windows Server 2019 (both standard and Server Core installations), Microsoft Windows Server 2022, and Microsoft Windows Server 2025 (both standard and Server Core installations) are affected by this vulnerability.

The CVSS score of 8.1 indicates a high severity level, meaning the flaw poses a significant risk to affected environments. The EPSS score is not available, so an immediate exploitation likelihood cannot be quantified, but the flaw is listed as not included in the CISA KEV catalog. The attacker’s main vector is network-based spoofing enabled by weak authentication; the attack requires network access to the AD FS endpoint and does not necessarily need privileged credentials.