CVE-2026-96222
Awaiting Analysis
Awaiting Analysis - Queue
Improper Certificate Validation in AD FS Allows Spoofing
Vulnerability report for CVE-2026-96222, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: Microsoft Corporation
Description
Description
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Microsoft | Microsoft | .NET Framework 3.5 3.5.0 |
| Microsoft | Microsoft | .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 3.0.0.0 |
| Microsoft | Microsoft | .NET Framework 3.5 AND 4.7.2 4.7.0 |
| Microsoft | Microsoft | .NET Framework 3.5 AND 4.8 4.8.0 |
| Microsoft | Microsoft | .NET Framework 3.5 AND 4.8.1 4.8.1 |
| Microsoft | Microsoft | .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0 |
| Microsoft | Microsoft | .NET Framework 4.8 4.8.0 |
| Microsoft | Microsoft | .NET Framework 4.8.1 4.8.0.0 |
| Microsoft | Microsoft | Visual Studio 2022 version 17.14 17.14.0 |
| Microsoft | Microsoft | Visual Studio 2026 version 18.10 18.10.0 |
| Microsoft | System.Security.Cryptography.Xml | 10.0.0 |
| Microsoft | Windows | 10 Version 1607 10.0.14393.0 |
| Microsoft | Windows | 10 Version 1809 10.0.17763.0 |
| Microsoft | Windows | Server 2012 R2 6.3.9600.0 |
| Microsoft | Windows | Server 2012 R2 (Server Core installation) 6.3.9600.0 |
| Microsoft | Windows | Server 2016 10.0.14393.0 |
| Microsoft | Windows | Server 2016 (Server Core installation) 10.0.14393.0 |
| Microsoft | Windows | Server 2019 10.0.17763.0 |
| Microsoft | Windows | Server 2019 (Server Core installation) 10.0.17763.0 |
| Microsoft | Windows | Server 2022 10.0.20348.0 |
| Microsoft | Windows | Server 2025 10.0.26100.0 |
| Microsoft | Windows | Server 2025 (Server Core installation) 10.0.26100.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
