CVE-2026-108131

CVE-2026-108131 · Active Directory Federation Services (AD FS) Spoofing Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

CVSS 7.5 · High · EPSS 0.7% · Fix available

Published: 2026-10-13T19:01:44.899Z
Updated: 2026-10-23T22:32:52.899Z

Affected products and versions

windows 10 version 1607
Versions
- ≥ 10.0.14393.0, < 10.0.14393.9612: Affected (custom)
Update to 10.0.14393.9612
windows 10 version 1809
Versions
- ≥ 10.0.17763.0, < 10.0.17763.9376: Affected (custom)
Update to 10.0.17763.9376
windows 10 version 21h2
Versions
- ≥ 10.0.19044.0, < 10.0.19044.7807: Affected (custom)
Update to 10.0.19044.7807
windows 10 version 22h2
Versions
- ≥ 10.0.19045.0, < 10.0.19045.7807: Affected (custom)
Update to 10.0.19045.7807
windows 11 version 23h2
Versions
- ≥ 10.0.22631.0, < 10.0.22631.7652: Affected (custom)
Update to 10.0.22631.7652
windows 11 version 24h2
Versions
- ≥ 10.0.26100.0, < 10.0.26100.9711: Affected (custom)
Update to 10.0.26100.9711
windows 11 version 25h2
Versions
- ≥ 10.0.26200.0, < 10.0.26200.9711: Affected (custom)
Update to 10.0.26200.9711
windows 11 version 26h1
Versions
- ≥ 10.0.28000.0, < 10.0.28000.3231: Affected (custom)
Update to 10.0.28000.3231
windows 11 version 26h2
Versions
- ≥ 10.0.26300.0, < 10.0.26300.9711: Affected (custom)
Update to 10.0.26300.9711
windows server 2012
Versions
- ≥ 6.2.9200.0, < 6.2.9200.26434: Affected (custom)
Update to 6.2.9200.26434
windows server 2012 (server core installation)
Versions
- ≥ 6.2.9200.0, < 6.2.9200.26434: Affected (custom)
Update to 6.2.9200.26434
windows server 2012 r2
Versions
- ≥ 6.3.9600.0, < 6.3.9600.23470: Affected (custom)
Update to 6.3.9600.23470
windows server 2012 r2 (server core installation)
Versions
- ≥ 6.3.9600.0, < 6.3.9600.23470: Affected (custom)
Update to 6.3.9600.23470
windows server 2016
Versions
- ≥ 10.0.14393.0, < 10.0.14393.9612: Affected (custom)
Update to 10.0.14393.9612
windows server 2016 (server core installation)
Versions
- ≥ 10.0.14393.0, < 10.0.14393.9612: Affected (custom)
Update to 10.0.14393.9612
windows server 2019
Versions
- ≥ 10.0.17763.0, < 10.0.17763.9376: Affected (custom)
Update to 10.0.17763.9376
windows server 2019 (server core installation)
Versions
- ≥ 10.0.17763.0, < 10.0.17763.9376: Affected (custom)
Update to 10.0.17763.9376
windows server 2022
Versions
- ≥ 10.0.20348.0, < 10.0.20348.5761: Affected (custom)
Update to 10.0.20348.5761
windows server 2025
Versions
- ≥ 10.0.26100.0, < 10.0.26100.33650: Affected (custom)
Update to 10.0.26100.33650
windows server 2025 (server core installation)
Versions
- ≥ 10.0.26100.0, < 10.0.26100.33650: Affected (custom)
Update to 10.0.26100.33650

Original sources

Check your server →