Open redirect in Microsoft Windows and Windows Server - CVE-2026-103576

Vulnerability details

The vulnerability allows a remote attacker to impersonate another user and access sensitive information.

The vulnerability exists due to URL redirection to an untrusted site ('open redirect') in Active Directory Federation Services (AD FS) when redirecting users to websites. A remote attacker can exploit the open redirect over a network to impersonate another user and access sensitive information.

Exploitation requires user interaction. The information accessible through impersonation depends on the victim user's permission levels.

Affected software

How to mitigate CVE-2026-103576

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103576
• https://support.microsoft.com/help/5126868

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows