CVE-2026-50647HighCVSS 7.5

Active Directory Federation Server Denial of Service Vulnerability

Published
July 17, 2026
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2026-50647 →

📋 Description

Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

🎯 Affected products75

  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1607 for 32-bit Systems
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1607 for x64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for 32-bit Systems
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2016
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2016 (Server Core installation)
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019 (Server Core installation)
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit Systems
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for 32-bit Systems
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for ARM64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for x64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 22H2 for 32-bit Systems
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 22H2 for ARM64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 22H2 for x64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 (Server Core installation)
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022 (Server Core installation)
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for 32-bit Systems
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for ARM64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for x64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for 32-bit Systems
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for ARM64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for x64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 23H2 for ARM64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 23H2 for x64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 24H2 for ARM64-based Systems
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 24H2 for x64-based Systems
  • +45 more not shown

✅ Remediation

KB5099538 (Security Update) — fixed build 10.0.17763.9020 KB5099540 (Security Update) — fixed build 10.0.20348.5386 KB5099539 (Security Update) — fixed build 10.0.19044.7548 KB5099539 (Security Update) — fixed build 10.0.19045.7548 KB5099536 (Security Update) — fixed build 10.0.26100.33158 KB5101650 (Security Update) — fixed build 10.0.26200.8875 KB5101650 (Security Update) — fixed build 10.0.26100.8875 KB5101649 (Security Update) — fixed build 10.0.28000.2525 KB5099535 (Security Update) — fixed build 10.0.14393.9339 KB5099445 (Monthly Rollup) — fixed build 6.2.9200.26226 KB5099444 (Monthly Rollup) — fixed build 6.3.9600.23291 KB5101007 (Security Update) — fixed build 4.8.4803.0 KB5101009 (Security Update) — fixed build 4.8.4803.0 KB5101011 (Security Update) — fixed build 4.8.4803.0 KB5101008 (Security Update) — fixed build 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 KB5101010 (Security Update) — fixed build 2.0.50727.9182 & 3.0.30729.9168 & 4.8.4803.0 KB5101006 (Security Update) — fixed build 2.0.50727.9182 & 3.0.30729.9168 & 4.8.4803.0 KB5100989 (Security Update) — fixed build 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 KB5099535 (Security Update) — fixed build 2.0.50727.8983 & 3.0.30729.8978 & 4.7.4143.0 KB5100990 (Security Update) — fixed build 4.7.4143.0 KB5100991 (Security Update) — fixed build 4.7.4143.0 KB5101005 (Security Update) — fixed build 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 KB5101000 (Security Update) — fixed build 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 KB5100998 (Security Update) — fixed build 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9340.0 KB5101004 (Security Update) — fixed build 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 KB5101001 (Security Update) — fixed build 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 KB5101002 (Security Update) — fixed build 4.8.9340.0

🔗 References (49)