CVE-2026-85321 in Active Directory Federation Services
Summary
by MITRE • 10/14/2026
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
Active Directory Federation Services, commonly referred to as AD FS, serves as a critical component within enterprise identity management infrastructures by facilitating single sign-on and federated authentication across organizational boundaries. The vulnerability described pertains to the handling of resource allocation during authentication requests, specifically lacking adequate limits or throttling mechanisms for incoming connections. This architectural oversight allows an unauthorized attacker to exploit the service by generating a high volume of authentication requests, thereby consuming excessive server resources such as CPU cycles, memory, and network bandwidth. Because AD FS is often positioned at the perimeter of internal networks to handle external identity assertions, its availability is paramount; any disruption directly impacts user access to cloud services, internal applications, and collaborative tools that rely on federated identities for secure entry.
The technical flaw lies in the absence of rate-limiting controls or request throttling within the AD FS service logic when processing authentication traffic. When an attacker sends a sustained stream of requests, potentially leveraging automated scripts or distributed botnets to amplify the attack volume, the server struggles to process these inputs efficiently. This leads to resource exhaustion, where legitimate users are unable to complete their authentication processes due to timeouts or connection resets. The impact is effectively a denial-of-service condition, disrupting business operations and creating opportunities for further exploitation if administrators attempt emergency recovery procedures that may inadvertently expose other system weaknesses. Such scenarios highlight the importance of implementing defense-in-depth strategies at both the network perimeter and application layers to mitigate volumetric attacks targeting identity services.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write or CWE-203: Observable Discrepancy in Resource Consumption, though it is most accurately categorized under CWE-400: Uncontrolled Resource Consumption. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1499: Endpoint Denial of Service and potentially T1190: Exploit Public-Facing Application if the attacker leverages specific application-layer exploits alongside resource exhaustion techniques. The lack of throttling means that standard rate-limiting defenses are insufficient without additional configuration or external mitigation strategies, such as Web Application Firewalls (WAF) configured to detect and block anomalous request rates directed at AD FS endpoints.
To mitigate this risk, organizations must implement robust traffic management solutions upstream from the AD FS servers. Deploying a reverse proxy or load balancer with built-in rate-limiting capabilities can effectively filter out malicious bursts of requests before they reach the identity server. Additionally, configuring Windows Network Load Balancing features to distribute and limit connections per source IP address provides an essential layer of protection. Administrators should also enable detailed logging on AD FS servers to monitor for unusual spikes in authentication failures or request volumes, allowing for rapid detection and response. Regular security assessments and penetration testing focused on availability controls are recommended to ensure that resource limits remain effective against evolving attack vectors targeting identity infrastructure.