CVE-2026-96222 in System.Security.Cryptography.Xml
Summary
by MITRE
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
Active Directory Federation Services serves as a critical identity provider within enterprise environments, facilitating single sign-on and federated authentication across organizational boundaries by issuing security tokens based on X.509 certificates. The vulnerability described involves a fundamental failure in the certificate validation logic embedded within this service architecture. Specifically, the system does not adequately verify the integrity or authenticity of digital certificates presented during the federation handshake process. This deficiency allows an attacker positioned to intercept network traffic between AD FS and its relying parties or identity providers to manipulate the authentication flow without possessing valid credentials for the target user accounts.
The technical flaw centers on a lack of strict certificate chain validation, potentially involving issues such as accepting self-signed certificates where trusted root authorities are required, failing to check expiration dates properly, or neglecting revocation status checks through Online Certificate Status Protocol or CRL distribution points. In many implementations of this nature, the service may accept any validly signed certificate if it matches a specific identifier or thumbprint that has been loosely configured, rather than enforcing strict trust anchor verification against known enterprise certification authorities. This misconfiguration effectively breaks the chain of trust that is essential for secure federated identity management, allowing an adversary to substitute legitimate certificates with malicious ones during transit.
From an operational perspective, this vulnerability enables sophisticated spoofing attacks where an attacker can impersonate a trusted relying party or even forge authentication tokens on behalf of other users. By intercepting and modifying the SAML assertions or OAuth tokens exchanged between AD FS and downstream applications, the adversary gains unauthorized access to protected resources such as email systems, cloud services like Microsoft 365, or internal web applications. The impact is severe because it bypasses traditional password-based authentication controls entirely, granting persistent access that can lead to data exfiltration, lateral movement within the network, and potential compromise of high-privilege accounts if administrative federation trusts are exploited.
This type of vulnerability aligns with CWE-295 Improper Certificate Validation and is often associated with MITM attacks categorized under ATT&CK technique T1078 Valid Accounts when combined with credential theft or token forgery techniques like T1556 Modify Authentication Process. To mitigate this risk, organizations must ensure that AD FS trusts are configured to require strict certificate validation against a trusted root store rather than relying on loose thumbprint matching for all incoming requests. Regular audits of federation trust configurations should be conducted to remove any overly permissive settings, and administrators should enforce the use of certificates issued by internal or public Certificate Authorities with proper revocation checking enabled. Additionally, implementing mutual TLS where applicable ensures that both parties verify each other's identities before establishing a secure channel, thereby neutralizing the ability of an attacker to inject fraudulent certificates into the authentication stream.