Improper certificate validation in AD FS permits an attacker to forge certificates and gain unauthorized authentication. The flaw allows the attacker to spoof identities over the network, potentially enabling impersonation of users and services that rely on AD FS for single sign‑on or token issuance. As AD FS is used across many workloads, the impact could result in broad unauthorized access to protected resources.

Microsoft AD FS services running on Windows Server 2012 R2 through Windows Server 2025, including Server Core editions, and Windows 10 versions 1607 and 1809. The vulnerability also affects Microsoft .NET Framework from 3.5 up to 4.8.1, Microsoft Visual Studio 2022 at version 17.14 and 2026 version 18.10, and the System.Security.Cryptography.Xml component.

The CVSS base score of 7.4 indicates a medium‑to‑high severity vulnerability. While the EPSS score is not available, the lack of a KEV listing suggests no known active exploitation, yet the potential for remote spoofing remains. The likely attack vector is over an open network to the AD FS service endpoint; the attacker must send crafted certificate requests. Successful exploitation would allow identity spoofing with elevated privileges, compromising all services that trust AD FS tokens.