Allocation of Resources Without Limits in Active Directory Federation Services

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Microsoft Corporation

Description

Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-72978

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	active_directory_federation_services	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability involves Active Directory Federation Services (AD FS) not properly limiting or throttling resource allocation. An unauthorized attacker can exploit this to send excessive requests, causing the service to become unavailable and denying service to legitimate users over a network.

Impact Analysis

If you rely on AD FS for authentication or services, this vulnerability could disrupt access for users and systems. It may lead to downtime, preventing employees or customers from logging in or accessing critical applications.

Mitigation Strategies

Apply the latest security updates from Microsoft for AD FS to address the resource allocation issue. Monitor network traffic for unusual patterns indicating denial of service attempts. Consider implementing rate limiting or throttling mechanisms for AD FS requests.

Hi! I’m here to help you understand CVE-2026-72978. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70