Improper Certificate Validation in Microsoft products - CVE-2026-96222

Vulnerability identifier: #VU155425

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-96222

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to improper certificate validation in Active Directory Federation Services (AD FS) when validating certificates during network communications. A remote attacker can exploit the certificate validation flaw over a network to perform spoofing.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

Microsoft Windows
Windows Server
Visual Studio
Microsoft .NET Framework

Install security update from vendor's website.

Microsoft Windows - addressed in versions 10 1607 10.0.14393.9612, 10 1809 10.0.17763.9376
Visual Studio - update to 17.14.42
Microsoft .NET Framework - addressed in versions 2.0.50727.8987 AND 3.0.30729.8982, 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0, 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0, 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0, 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0, 4.7.4150.0, 4.8.4811.0
Windows Server - addressed in versions 2012 R2 6.3.9600.23470, 2016 10.0.14393.9612, 2019 10.0.17763.9376, 2022 10.0.20348.5761, 2025 10.0.26100.33650

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96222
• https://www.nuget.org/packages/System.Security.Cryptography.Xml

• Multiple vulnerabilities in Microsoft Windows