Active Directory vulnerabilities patched in Microsoft’s October 2026 security updates include multiple flaws in Active Directory Federation Services that could allow unauthenticated remote attackers to bypass security protections or perform spoofing attacks.
The issues affect Active Directory Federation Services, commonly known as AD FS, an enterprise identity component used to provide federated authentication and single sign-on between trusted systems and applications.
Among the newly disclosed issues are CVE-2026-69982, CVE-2026-96252, and CVE-2026-108131.
Microsoft released fixes for the vulnerabilities as part of its October 13, 2026 security updates.
For broader coverage of enterprise vulnerabilities and patching priorities, see our CVE and Vulnerability Exploits 2026 Hub.
Key Takeaway
The newly disclosed Active Directory vulnerabilities affect Microsoft’s AD FS identity infrastructure and include security feature bypass and spoofing weaknesses that can be reached over a network.
Two of the issues involve spoofing, while CVE-2026-69982 involves weak authentication that can allow a remote unauthorized attacker to bypass a security feature.
Microsoft has released security updates, and there is currently no public evidence that these specific vulnerabilities are being actively exploited in the wild.
3 Active Directory Vulnerabilities Affect Microsoft AD FS
The vulnerabilities discussed in this update specifically affect Active Directory Federation Services rather than every Active Directory component.
AD FS provides federation services that allow organizations to authenticate users across applications, domains and trusted environments without requiring separate credentials for every service.
Because AD FS operates close to enterprise authentication and trust boundaries, weaknesses in this layer deserve careful attention even when a vulnerability does not directly provide full domain administrator access.
The three notable CVEs are:
- CVE-2026-69982 — AD FS Security Feature Bypass
- CVE-2026-96252 — AD FS Spoofing Vulnerability
- CVE-2026-108131 — AD FS Spoofing Vulnerability
CVE-2026-69982 Allows Remote Security Feature Bypass
CVE-2026-69982 is an Active Directory Federation Services security feature bypass vulnerability.
Microsoft describes the flaw as a weak authentication issue that can allow an unauthorized attacker to bypass a security feature over a network.
The vulnerability is associated with CWE-1390, Weak Authentication.
Its published CVSS 3.1 score is 5.9.
The CVSS vector indicates:
- Network-based attack vector
- No privileges required
- No user interaction required
- High attack complexity
- Integrity impact if successfully exploited
The high attack-complexity requirement means exploitation is not necessarily trivial, but the lack of authentication and user interaction still makes the flaw important for exposed federation infrastructure.
CVE-2026-96252 Is a High-Impact AD FS Spoofing Flaw
CVE-2026-96252 is an AD FS spoofing vulnerability caused by improper verification of a cryptographic signature.
Microsoft’s published description states that the weakness can allow an unauthorized attacker to perform spoofing over a network.
The vulnerability is classified under CWE-347: Improper Verification of Cryptographic Signature.
Its CVSS 3.1 score is 9.1, with the following important characteristics:
- Remote network attack
- Low attack complexity
- No privileges required
- No user interaction required
- High confidentiality impact
- High integrity impact
Those characteristics make CVE-2026-96252 one of the most serious issues in the group from a technical-risk perspective.
CVE-2026-108131 Also Enables AD FS Spoofing
CVE-2026-108131 is another Active Directory Federation Services spoofing vulnerability addressed in the October security updates.
Microsoft says an unauthorized attacker can perform spoofing over a network.
The vulnerability carries a CVSS 3.1 score of 7.5.
Microsoft’s public security data lists the flaw across multiple supported Windows and Windows Server releases, making it important for organizations operating AD FS infrastructure on supported Microsoft platforms.
Security Feature Bypass Does Not Automatically Mean Domain Takeover
The phrase “Active Directory vulnerability” can easily be interpreted as a complete domain compromise, but that would overstate the currently documented impact.
CVE-2026-69982 is classified as a security feature bypass, while CVE-2026-96252 and CVE-2026-108131 are spoofing vulnerabilities.
Microsoft does not describe these three issues as direct remote code execution vulnerabilities or automatic domain administrator compromise.
However, identity security flaws can become significantly more dangerous when combined with:
- Stolen credentials
- Phishing
- Existing network access
- Lateral movement
- Misconfigured trust relationships
- Other privilege-escalation vulnerabilities
Why AD FS Security Matters
Active Directory Federation Services often sits at the boundary between users, applications and enterprise identity systems.
Organizations may use AD FS to provide single sign-on and federated authentication for internal applications, external partners and cloud-connected services.
A weakness in that trust layer can therefore affect more than one standalone application.
Attackers targeting enterprise environments frequently attempt to move toward identity infrastructure because authentication systems can influence access to many downstream resources.
Identity Infrastructure Remains a High-Value Attack Target
The newly patched AD FS issues follow a broader pattern of vulnerabilities affecting enterprise identity and access systems.
CyberUpdates365 recently covered 22 vulnerabilities in IBM Verify Access, including authentication bypass and critical remote code execution flaws affecting another major enterprise identity platform.
While the IBM vulnerabilities and the Microsoft AD FS flaws are technically separate incidents, both highlight why authentication and identity infrastructure should receive high patching priority.
Which Systems May Need Attention?
Microsoft’s vulnerability records list affected Windows and Windows Server versions depending on the specific CVE.
The relevant releases include several generations of Windows Server, including:
- Windows Server 2012 and 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025
Some vulnerability records also list Windows client releases because affected components or shared code may exist across multiple Windows platforms.
Administrators should use Microsoft’s Security Update Guide for each CVE as the source of truth for the exact affected products and update packages.
Microsoft Released Fixes in October 2026 Updates
The three vulnerabilities were publicly disclosed with Microsoft’s October 13, 2026 security updates.
Organizations running AD FS should make sure that all relevant federation servers have received the applicable Windows cumulative or security updates.
Patching only one federation server may leave an environment exposed if additional AD FS nodes remain outdated.
Administrators Should Inventory Every AD FS Server
Before considering remediation complete, security teams should identify every server participating in the federation environment.
This includes:
- Primary AD FS servers
- Secondary federation servers
- Older systems retained for compatibility
- Remote-office infrastructure
- Disaster-recovery systems
- Test or staging federation servers connected to production identity services
Forgotten or lightly managed identity servers can create a security gap even when primary production systems are patched.
Do Not Expose Federation Services More Than Necessary
Network controls remain important even after patches are available.
Administrators should review how AD FS systems are reachable from internal and external networks.
Recommended controls include:
- Restrict unnecessary direct network access to federation servers
- Use firewalls to limit administrative access
- Separate privileged administration from normal user networks
- Use strong authentication for administrator accounts
- Limit service accounts to the permissions they actually require
- Monitor federation endpoints for unusual activity
Review Authentication and Federation Logs
Organizations should also monitor identity infrastructure for behavior that could indicate attempted abuse.
Useful signals include:
- Unexpected authentication failures
- Unusual token or federation activity
- New or modified service accounts
- Unexpected privilege changes
- Authentication attempts from unfamiliar systems
- Changes to federation configuration
- Suspicious administrative activity on AD FS servers
Organizations should establish normal authentication patterns so anomalous behavior can be identified more quickly.
No Evidence of Active Exploitation
Microsoft’s available security information does not indicate that CVE-2026-69982, CVE-2026-96252 or CVE-2026-108131 are currently being exploited in real-world attacks.
The vulnerabilities are also not listed as known exploited vulnerabilities based on the currently available public records reviewed for this report.
That does not mean organizations should delay patching.
Once security updates and vulnerability details are public, attackers can analyze the changes and attempt to reproduce vulnerable behavior.
Microsoft’s October Patch Cycle Includes Many Other AD FS Fixes
The three vulnerabilities highlighted here are not the only AD FS issues addressed in Microsoft’s October 2026 update cycle.
Microsoft also fixed additional security feature bypass, denial-of-service, information disclosure and spoofing vulnerabilities affecting Active Directory Federation Services.
That broader volume of AD FS fixes makes it particularly important for administrators to apply the full security update rather than attempting to remediate only one CVE.
AD FS Administrators Should Also Review DKM Hardening
Microsoft’s October update also advances a separate AD FS security-hardening change related to the Distributed Key Manager, or DKM, container.
Microsoft previously disclosed CVE-2026-56155, an elevation-of-privilege issue involving overly permissive access controls on the AD FS DKM container.
Starting with the October 13, 2026 Windows security update, AD FS automatically remediates insecure DKM container ACLs by default.
The DKM container is security-sensitive because AD FS uses it to protect keys associated with token-signing and token-encryption certificates.
Administrators should therefore review Microsoft’s DKM hardening guidance alongside the new vulnerability fixes.
What Enterprise Security Teams Should Do Now
Organizations using AD FS should take the following actions:
- Identify all AD FS servers
- Install Microsoft’s October 2026 security updates
- Verify successful installation on every federation node
- Review Microsoft’s advisory for each relevant CVE
- Review AD FS and authentication logs for anomalies
- Restrict administrative access to trusted networks
- Use dedicated privileged accounts for identity administration
- Review federation trusts and service accounts
- Confirm backup and disaster-recovery servers are also patched
- Review DKM ACL hardening behavior introduced in the October update
Frequently Asked Questions
What are the new Active Directory vulnerabilities?
The vulnerabilities highlighted here are flaws in Microsoft Active Directory Federation Services, including CVE-2026-69982, CVE-2026-96252 and CVE-2026-108131.
Are these vulnerabilities in normal Active Directory domain controllers?
The published issues specifically concern Active Directory Federation Services. Organizations should not assume every Active Directory domain controller is vulnerable simply because it participates in an AD environment.
Can the flaws be exploited remotely?
Yes. Microsoft’s published descriptions indicate network-based attack vectors for the three vulnerabilities.
Does an attacker need authentication?
The published descriptions indicate that unauthorized or unauthenticated attackers can reach the vulnerable conditions for the three highlighted flaws.
Which vulnerability is the most severe?
CVE-2026-96252 has a published CVSS 3.1 score of 9.1 and can allow an unauthenticated remote attacker to perform spoofing because of improper cryptographic-signature verification.
Are these Active Directory vulnerabilities being actively exploited?
There is currently no public evidence that these three vulnerabilities are being actively exploited in the wild.
How should administrators fix the issues?
Administrators should install the applicable Microsoft October 2026 security updates on all affected AD FS systems and verify successful deployment.
Final Takeaway
The October 2026 Active Directory vulnerabilities highlight the importance of protecting federation and identity infrastructure with the same urgency applied to internet-facing servers and remote-access systems.
CVE-2026-69982 can allow a remote unauthorized attacker to bypass a security feature because of weak authentication, while CVE-2026-96252 and CVE-2026-108131 affect AD FS spoofing protections.
Microsoft has released security updates, and organizations using Active Directory Federation Services should patch all federation nodes, review authentication activity and verify that older or backup systems are not left behind.
There is no confirmed active exploitation of the three highlighted vulnerabilities at the time of publication.
