CVE-2026-96222
7.4
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability: 2.2 / Impact: 5.2
Source: secure@microsoft.com (Secondary)
Description
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Affected (29)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| version < 10.0.14393.9612 | |
| version < 10.0.17763.9376 | |
| All versions | |
| version < 10.0.14393.9612 | |
| version < 10.0.17763.9376 | |
| version < 10.0.20348.5761 | |
| version < 10.0.26100.33650 |
Configuration B
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| 17.14.0 ≤ version < 17.14.42 | |
| 18.10.0 ≤ version < 18.10.4 |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| Version 4.8.1 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows 11 26h1 | All versions |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| Version 4.8 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows 10 1607 | All versions |
Microsoft Windows Server 2012 | All versions |
Microsoft Windows Server 2016 | All versions |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| Version 4.6.2 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows Server 2012 | All versions |
Configuration G
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.5 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows 10 1809 | All versions |
Microsoft Windows 10 21h2 | All versions |
Microsoft Windows 10 22h2 | All versions |
Microsoft Windows Server 2019 | All versions |
Microsoft Windows Server 2022 | All versions |
Configuration H
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.5 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows 10 21h2 | All versions |
Microsoft Windows 10 22h2 | All versions |
Microsoft Windows 11 23h2 | All versions |
Microsoft Windows 11 24h2 | All versions |
Microsoft Windows 11 25h2 | All versions |
Microsoft Windows 11 26h2 | All versions |
Microsoft Windows Server 2022 | All versions |
Microsoft Windows Server 2025 | All versions |
Configuration I
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.5 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows 10 1607 | All versions |
Microsoft Windows Server 2016 | All versions |
Microsoft Windows Server 2019 | All versions |
Configuration J
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.5 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows 11 26h1 | All versions |
Microsoft Windows Server 2012 | All versions |
References (1)
Source: secure@microsoft.com
Vendor Advisory
Timeline
No history available yet.