This vulnerability arises from the lack of resource allocation limits in Active Directory Federation Services (AD FS). An attacker who is not authenticated can send specially crafted requests that cause AD FS to consume excessive memory or CPU resources, ultimately leading to service refusal. The primary impact is a denial of service, affecting the availability of AD FS for all users on the affected Windows Server platforms.

Microsoft Windows Server 2012 R2, including Server Core installations, Windows Server 2016 (full and Server Core), Windows Server 2019 (full and Server Core), Windows Server 2022, and Windows Server 2025 (full and Server Core). These versions host the AD FS role and are specifically impacted by the unthrottled resource allocation flaw.

The CVSS base score of 7.5 classifies this flaw as high severity, and the EPSS score is 1%, indicating a low exploitation probability. The flaw remains publicly documented by Microsoft and is not listed in CISA's KEV catalog. The likely attack vector is a remote network attacker sending crafted requests to the AD FS endpoint. No authentication is required, and successful exploitation can render the AD FS service non‑responsive, preventing authentication for client applications.