The vulnerability is an information disclosure that permits an unauthorized attacker to obtain data from Active Directory Federation Services (AD FS) over a network. It stems from an observable discrepancy in AD FS that enables an unauthenticated client to read sensitive information. Attackers could leak confidential identity or configuration details, compromising confidentiality and potentially the integrity of federation data.

The affected systems are Microsoft Windows operating systems (Windows 10, Windows 11, and Windows Server versions 2012 through 2025) running .NET Framework 3.5 up to 4.8.1, as well as Windows 10 and 11 releases ranging from version 1607 to 26H2, including ARM64 builds. AD FS services deployed on these platforms are impacted.

The CVSS score of 7.5 indicates a high severity for this flaw. Because the attack vector is remote network communication to AD FS endpoints, the vulnerability can be exploited by attackers with network reach to those services, even without authentication. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation at this time. Nonetheless, the potential loss of sensitive federation data warrants immediate attention. Mitigation through patching or network restriction can substantially reduce the likelihood of abuse.