What is CVE-2026-97788?

CVE-2026-97788 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Active Directory Federation Services (AD FS) Information Disclosure Vulnerability

Which CVE IDs does CVE-2026-97788 cover?

CVE-2026-97788 covers the following CVE IDs: CVE-2026-97788. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2026-97788?

CVE-2026-97788 has a CVSS v3 base score of 7.5, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2026-97788?

CVE-2026-97788 affects 59 products, including: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809; Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809; and others — see the full list on the advisory page.

CVE-2026-97788HighCVSS 7.5

Active Directory Federation Services (AD FS) Information Disclosure Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

October 13, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-97788 →

📋 Description

Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.

🎯 Affected products59

Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019
Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2
Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019
Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
Microsoft .NET Framework 3.5 on Windows 11 version 26H1
Microsoft .NET Framework 3.5 on Windows Server 2012
Microsoft .NET Framework 3.5 on Windows Server 2012 R2
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2
Microsoft .NET Framework 4.8 on Windows 10 version 1607
Microsoft .NET Framework 4.8 on Windows Server 2012
Microsoft .NET Framework 4.8 on Windows Server 2012 R2
Microsoft .NET Framework 4.8 on Windows Server 2016
Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
+29 more not shown

✅ Remediation

KB5126868 (Security Update) — fixed build 10.0.14393.9612 KB5126835 (Security Update) — fixed build 6.2.9200.26434 KB5126657 (Security Update) — fixed build 10.0.19044.7807 KB5126653 (Security Update) — fixed build 10.0.22631.7652 KB5127648 (Security Update) — fixed build 10.0.26100.9711 KB5127648 (Security Update) — fixed build 10.0.26200.9711 KB5127648 (Security Update) — fixed build 10.0.26300.9711 KB5127646 (Security Update) — fixed build 10.0.28000.3231 KB5126836 (Security Update) — fixed build 6.3.9600.23470 KB5126651 (Security Update) — fixed build 10.0.17763.9376 KB5126655 (Security Update) — fixed build 10.0.20348.5761 KB5126646 (Security Update) — fixed build 10.0.26100.33650 KB5127689 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127690 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127691 (Security Update) — fixed build 4.8.9363.0 KB5127692 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127693 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127694 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0 KB5127696 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 KB5127660 (Security Update) — fixed build 2.0.50727.8987 AND 3.0.30729.8982 KB5127664 (Security Update) — fixed build 2.0.50727.8987 AND 3.0.30729.8982 KB5126868 (Security Update) — fixed build 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 KB5127666 (Security Update) — fixed build 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 KB5127685 (Security Update) — fixed build 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 KB5127683 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 KB5127687 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 KB5127667 (Security Update) — fixed build 4.7.4150.0 KB5127668 (Security Update) — fixed build 4.7.4150.0 KB5127684 (Security Update) — fixed build 4.8.4811.0 KB5127686 (Security Update) — fixed build 4.8.4811.0 KB5127688 (Security Update) — fixed build 4.8.4811.0

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products59

✅ Remediation

🔗 References (58)