PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-85321 Microsoft CVE debrief

Microsoft has released a vulnerability note for Active Directory Federation Services (AD FS) Denial of Service Vulnerability. CVE-2026-85321 has been publicly disclosed and has a CVSS score of 7.5. The vulnerability affects multiple versions of Windows Server, including 2012 R2, 2016, 2019, 2022, and 2025, as well as their Server Core installations. Defenders responsible for Windows Server deployments, particularly those using Active Directory Federation Services (AD FS), should assess exposure and prioritize patching vulnerable versions. Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny or

Vendor
Microsoft
Product
Windows Server 2012 R2
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-13
Original CVE updated
2026-10-13
Advisory published
2026-10-13
Advisory updated
2026-10-13

Who should care

Defenders responsible for Windows Server deployments, particularly those using Active Directory Federation Services (AD FS), should assess exposure and prioritize patching vulnerable versions.

Why it matters

CVE-2026-85321 is a high-severity denial-of-service vulnerability in Active Directory Federation Services (AD FS) that requires prompt attention from defenders responsible for Windows Server deployments.

  • Denial-of-service attacks against AD FS could impact authentication and authorization processes.
  • Successful exploitation could lead to service disruption, affecting business operations.
  • Defenders should verify affected versions and apply patches or updates to prevent potential attacks.
  • Remediation priority is high due to the potential for service disruption.

Technical summary

CVE-2026-85321 is a denial-of-service vulnerability in Active Directory Federation Services (AD FS) that allows an unauthorized attacker to deny service over a network. The vulnerability affects multiple versions of Windows Server, including 2012 R2, 2016, 2019, 2022, and 2025, as well as their Server Core installations.

Defensive priority

Defenders should prioritize patching vulnerable Windows Server versions, including 2012 R2, 2016, 2019, 2022, and 2025, as well as their Server Core installations.

Recommended defensive actions

  • Patch vulnerable Windows Server versions, including 2012 R2, 2016, 2019, 2022, and 2025, as well as their Server Core installations.
  • Verify affected versions and apply patches or updates accordingly.
  • Monitor AD FS for potential denial-of-service attacks.

Evidence notes

The CVE Program and NVD have provided official records and details about the vulnerability. Microsoft has also provided a vulnerability note for CVE-2026-85321.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-85321 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-85321

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-85321 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85321

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.