Improper verification of cryptographic signatures in Active Directory Federation Services (AD FS) allows an attacker to forge legitimate tokens and impersonate users or services. This vulnerability is a classic message integrity flaw (CWE-347) that can compromise authentication flows, potentially enabling attackers to gain unauthorized access or elevate privileges. The impact extends to any system relying on AD FS for single sign‑on or federation, affecting both internal users and external partners.

Affected SysAdmins should examine deployments of Microsoft Windows 10 versions 1607 and 1809, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core variants. These operating systems host the vulnerable AD FS component and therefore must be updated to remediate the flaw.

The CVSS score of 9.1 indicates high severity, and the vulnerability is exploitable over a network via AD FS endpoints. While no EPSS score is presently available, the lack of KEV listing does not preclude active exploitation. Attackers with remote network access to the AD FS service could craft forged tokens to impersonate valid identities without needing user credentials, thereby subverting authentication mechanisms. The exploit requires only connectivity to the AD FS server and does not rely on elevated system privileges on the target host.