Microsoft Flags Critical AD FS Crypto Verification Failure CVE-2026-96252 Enabling Network Spoofing Attacks

Microsoft has published an advisory for CVE-2026-96252, a critical vulnerability affecting Active Directory Federation Services. The issue allows an unauthorised attacker to perform spoofing over a network by exploiting improper cryptographic signature verification. This affects organisations relying on AD FS for identity management and single sign-on capabilities across their enterprise environments.

Root cause

The underlying technical failure involves the improper verification of cryptographic signatures within the service. According to the National Vulnerability Database, this maps to CWE-347, indicating a fundamental weakness in how digital signatures are validated. This allows an unauthorised attacker to perform spoofing, as described in the official advisory from Microsoft Security Update Guide.

Attack path

An unauthorised attacker can exploit this flaw remotely over a network. The source material indicates that the attacker can perform spoofing over a network. The advisory does not specify further details on the attack path beyond the capability to perform spoofing via improper signature verification.

Affected versions

The official advisory from Microsoft Security Update Guide confirms the presence of the vulnerability in Active Directory Federation Services. While the specific version numbers are not detailed in the provided summary, the advisory applies to deployments of the service that handle cryptographic signature verification as described in the vulnerability record.

Mitigation

• Monitor network traffic for anomalous authentication attempts or unexpected federation requests.
• Review logs for signs of spoofing or invalid signature errors within AD FS.
• Await official patches from Microsoft to address the cryptographic verification flaw.
• Ensure strict access controls are in place for network segments hosting AD FS.

What it means for organisations

Security teams must immediately assess their exposure to this identity infrastructure flaw. Organisations should determine which internal and external services rely on AD FS for authentication. It is crucial to inform network operations and identity management groups about the potential for remote spoofing. Review existing monitoring rules to detect unusual authentication patterns that may indicate exploitation attempts against the federation service.

Background: Active Directory attacks

Watch for abnormal Kerberos ticket requests and unexpected DCOM activity. Early signs include rapid account enumeration and unusual service principal name modifications. Respond by isolating affected endpoints and rotating credentials immediately to prevent further domain traversal.

Read the full guide: Active Directory Attack Warning Signs Early Detection Methods

What to do and how to stay safe: Microsoft

• Audit current AD FS configurations to identify any customised signature verification logic.
• Implement strict network segmentation to limit remote access to federation endpoints.
• Enable detailed logging on identity servers to capture potential spoofing attempts.
• Prepare incident response procedures for identity compromise scenarios.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-96252?

The National Vulnerability Database rates it as Critical with a CVSS score of 9.1.

Can this be exploited remotely?

Yes, the advisory states an unauthorised attacker can perform spoofing over a network.

Is there a patch available?

The source material does not confirm a patch release; no fix has been confirmed yet.