The vulnerability occurs when AD FS allocates resources without limits or throttling, allowing an attacker to trigger an unauthorized resource exhaustion event over the network. This flaw, classified under CWE‑770, can cause AD FS to become unresponsive, preventing legitimate users from authenticating and disrupting business operations. The likely attack vector is network based, as an attacker sends specially crafted requests to the AD FS endpoint.

Affected products include Microsoft Windows 10 version 1607 and version 1809, Windows Server 2012 (including Server Core installations), Windows Server 2012 R2 (including Server Core installations), Windows Server 2016 (including Server Core installations), Windows Server 2019 (including Server Core installations), Windows Server 2022, Windows Server 2025, and Windows Server 2025 (Server Core installations).

The CVSS score is 7.5, indicating high severity. EPSS score is 1%, indicating a low but nonzero probability of exploitation. The vulnerability is not listed in CISA KEV and no publicly available exploit has been reported. Exploitation requires a remote attacker to send crafted requests that cause AD FS to allocate memory or threads without limit, eventually exhausting system resources. Access to the AD FS service over the network is a prerequisite, allowing an attacker to trigger the denial of service from a remote location.