CVE-2026-50647

Analyzed Analyzed - Analysis Complete

AD FS Infinite Loop Denial of Service

Publication date: 2026-07-14

Last updated on: 2026-07-24

Assigner: Microsoft Corporation

Description

Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-24

Generated

2026-08-03

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-50647

EUVD

EUVD-2026-44118

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_server_2012	r2
microsoft	windows_server_2012	*
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_server_2016	to 10.0.14393.9339 (exc)
microsoft	windows_server_2019	to 10.0.17763.9020 (exc)
microsoft	windows_server_2022	to 10.0.20348.5386 (exc)
microsoft	windows_server_2025	to 10.0.26100.33158 (exc)
microsoft	windows_11_26h1	to 10.0.28000.2525 (exc)
microsoft	windows_11_26h1	to 10.0.28000.2525 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8875 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8875 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8875 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8875 (exc)
microsoft	.net_framework	4.8.1
microsoft	.net_framework	4.8
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability is an infinite loop flaw in Active Directory Federation Services (AD FS). An attacker can exploit it to cause a denial of service over a network without needing authentication.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. Monitoring for unusual network traffic patterns or service disruptions in AD FS may help detect potential exploitation.

Impact Analysis

It can disrupt services by causing AD FS to hang or crash, leading to downtime for federated authentication and access to dependent applications.

Compliance Impact

This vulnerability enables denial of service attacks, which could disrupt critical services handling sensitive data. Such disruptions may violate compliance requirements for availability in GDPR (Article 32) and HIPAA (Security Rule §164.312).

Mitigation Strategies

Apply the latest security updates from Microsoft for AD FS as soon as possible to patch the infinite loop vulnerability. Monitor network traffic for unusual patterns indicating a denial of service attempt.

Hi! I’m here to help you understand CVE-2026-50647. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70