CVE-2026-85319 in Active Directory Federation Services
Summary
by MITRE • 10/14/2026
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
Active Directory Federation Services, commonly referred to as AD FS, serves as a critical identity and access management solution within Microsoft enterprise environments. It facilitates single sign-on capabilities by acting as a security token service that issues tokens for federated identities across organizational boundaries or between different domains. The architecture of AD FS involves handling numerous authentication requests, validating credentials, and issuing security tokens to relying parties. This process requires significant computational resources including CPU cycles, memory allocation, and network bandwidth. When the system processes these requests, it must manage resource consumption efficiently to maintain availability for legitimate users while preventing abuse by malicious actors.
The identified vulnerability stems from an improper implementation of resource management controls within the AD FS service logic. Specifically, the application fails to enforce limits or throttling mechanisms on incoming authentication and token issuance requests. This lack of rate limiting means that there is no upper bound on the number of concurrent connections or the frequency at which a single client can submit requests. Consequently, an attacker who gains network access to the AD FS endpoint can exploit this deficiency by flooding the service with a high volume of authentication attempts or complex cryptographic operations. Because the server does not restrict these inputs based on source IP address, user identity, or request complexity, it continues to allocate processing power and memory for each incoming connection until system resources are exhausted.
This flaw directly leads to a denial-of-service condition affecting both the AD FS infrastructure and potentially downstream systems that rely on its authentication services. When an attacker initiates a sustained flood of requests, the server's CPU utilization spikes dramatically as it attempts to process each request individually. Memory consumption increases due to the creation of new threads or processes for incoming connections, eventually leading to resource exhaustion. Legitimate users attempting to authenticate will experience timeouts, slow response times, or complete failure to obtain security tokens. In severe cases, the AD FS service may crash entirely, requiring a manual restart and causing significant disruption to business operations that depend on federated identity solutions such as Office 365 access, Azure Active Directory integration, or internal application logins.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write if the resource exhaustion leads to memory corruption, but more accurately it falls under CWE-400: Uncontrolled Resource Consumption. This category encompasses scenarios where an actor can cause a system to consume excessive resources, leading to degradation or failure of service. In terms of offensive security frameworks, this vulnerability is exploitable via MITRE ATT&CK technique T1498: Network Denial of Service. Attackers utilize this method to disrupt the availability of networked machines and services by overwhelming them with traffic or requests that consume disproportionate amounts of system resources. The attack vector typically involves remote exploitation over TCP/IP, allowing adversaries located outside the immediate perimeter to launch these denial-of-service campaigns without needing prior local access.
Mitigating this vulnerability requires a multi-layered approach focusing on both infrastructure-level controls and application-specific configurations. Network administrators should implement rate limiting at the load balancer or reverse proxy level in front of AD FS servers. This ensures that individual IP addresses cannot exceed a defined threshold of requests per second, effectively neutralizing volumetric attacks before they reach the vulnerable service. Additionally, enabling Windows Firewall rules to restrict access to AD FS endpoints only from trusted subnets and specific application gateway IPs can reduce the attack surface. Microsoft has historically released security updates addressing resource exhaustion flaws in AD FS; therefore, ensuring that all servers are patched with the latest cumulative updates is essential. Furthermore, configuring Web Application Firewalls (WAF) to detect and block anomalous traffic patterns associated with brute-force or flooding attacks provides an additional layer of defense against exploitation attempts targeting this specific weakness.