Improper Verification of Cryptographic Signature in Microsoft Windows and Windows Server - CVE-2026-96252
Published: October 14, 2026
Vulnerability identifier: #VU155448
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96252
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to create an unauthorized session and obtain tokens.
The vulnerability exists due to improper verification of cryptographic signatures in Active Directory Federation Services (AD FS) when processing SAML responses. A remote attacker can relay a validly signed SAML response intended for a different endpoint to an affected AD FS endpoint to create an unauthorized session and obtain tokens.
No user interaction is required.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2026-96252
Install security update from vendor's website.
Microsoft Windows - addressed in versions 10 1607 10.0.14393.9612, 10 1809 10.0.17763.9376
Windows Server - addressed in versions 2012 R2 6.3.9600.23470, 2012 6.2.9200.26434, 2016 10.0.14393.9612, 2019 10.0.17763.9376, 2022 10.0.20348.5761, 2025 10.0.26100.33650
Windows Server - addressed in versions 2012 R2 6.3.9600.23470, 2012 6.2.9200.26434, 2016 10.0.14393.9612, 2019 10.0.17763.9376, 2022 10.0.20348.5761, 2025 10.0.26100.33650