CVE-2026-96222CriticalCVSS 7.4

Active Directory Federation Services (AD FS) Spoofing Vulnerability

Published
October 13, 2026
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2026-96222 →

📋 Description

Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

🎯 Affected products46

  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
  • Microsoft .NET Framework 3.5 on Windows 11 version 26H1
  • Microsoft .NET Framework 3.5 on Windows Server 2012
  • Microsoft .NET Framework 3.5 on Windows Server 2012 R2
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2
  • Microsoft .NET Framework 4.8 on Windows 10 version 1607
  • Microsoft .NET Framework 4.8 on Windows Server 2012
  • Microsoft .NET Framework 4.8 on Windows Server 2012 R2
  • Microsoft .NET Framework 4.8 on Windows Server 2016
  • Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1
  • Microsoft Visual Studio 2022 version 17.14
  • Microsoft Visual Studio 2026 version 18.10
  • System.Security.Cryptography.Xml on .NET 8.0 installed on Linux
  • +16 more not shown

✅ Remediation

KBRelease Notes (Security Update) — fixed build 8.0.5 KB5126651 (Security Update) — fixed build 10.0.17763.9376 KB5126655 (Security Update) — fixed build 10.0.20348.5761 KB5126646 (Security Update) — fixed build 10.0.26100.33650 KB5126868 (Security Update) — fixed build 10.0.14393.9612 KB5126836 (Security Update) — fixed build 6.3.9600.23470 KBRelease Notes (Security Update) — fixed build 18.10.4 KBRelease Notes (Security Update) — fixed build 17.14.42 KB5127689 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127690 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127691 (Security Update) — fixed build 4.8.9363.0 KB5127692 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127693 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127694 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0 KB5127696 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 KB5127660 (Security Update) — fixed build 2.0.50727.8987 AND 3.0.30729.8982 KB5127664 (Security Update) — fixed build 2.0.50727.8987 AND 3.0.30729.8982 KB5126868 (Security Update) — fixed build 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 KB5127666 (Security Update) — fixed build 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 KB5127685 (Security Update) — fixed build 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 KB5127683 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 KB5127687 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 KB5127667 (Security Update) — fixed build 4.7.4150.0 KB5127668 (Security Update) — fixed build 4.7.4150.0 KB5127684 (Security Update) — fixed build 4.8.4811.0 KB5127686 (Security Update) — fixed build 4.8.4811.0 KB5127688 (Security Update) — fixed build 4.8.4811.0

🔗 References (49)