CVE-2026-83674

Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83674	Vendor Advisory Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_10_1607:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1607:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_1809:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1809:::::::x86:*
	cpe:2.3:o:microsoft:windows_server_2016::::::::
	cpe:2.3:o:microsoft:windows_server_2019::::::::
	cpe:2.3:o:microsoft:windows_server_2022:::::::x64:*
	cpe:2.3:o:microsoft:windows_server_2025:::::::x64:*

History

29 Oct 2026, 20:51

Type	Values Removed	Values Added
CPE		cpe:2.3:o:microsoft:windows_10_1809:::::::x64:* cpe:2.3:o:microsoft:windows_server_2025:::::::x64:* cpe:2.3:o:microsoft:windows_10_1809:::::::x86:* cpe:2.3:o:microsoft:windows_server_2016:::::::: cpe:2.3:o:microsoft:windows_10_1607:::::::x64:* cpe:2.3:o:microsoft:windows_server_2022:::::::x64:* cpe:2.3:o:microsoft:windows_10_1607:::::::x86:* cpe:2.3:o:microsoft:windows_server_2019::::::::
References	~~() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83674 -~~	() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83674 - Vendor Advisory, Patch
First Time		Microsoft windows Server 2019 Microsoft Microsoft windows 10 1809 Microsoft windows Server 2016 Microsoft windows Server 2025 Microsoft windows Server 2022 Microsoft windows 10 1607

13 Oct 2026, 19:20

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-13 19:20

Updated : 2026-10-29 20:51

NVD link : CVE-2026-83674

Mitre link : CVE-2026-83674

CVE.ORG link : CVE-2026-83674

JSON object : View

Products Affected

microsoft

windows_10_1607
windows_server_2016
windows_server_2019
windows_server_2025
windows_10_1809
windows_server_2022

CWE

CWE-1390

Weak Authentication

{"id": "CVE-2026-83674", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-83674", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-08T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secure@microsoft.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "secure@microsoft.com", "affectedData": [{"vendor": "Microsoft", "product": "Windows 10 Version 1607", "versions": [{"status": "affected", "version": "10.0.14393.0", "lessThan": "10.0.14393.9612", "versionType": "custom"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows 10 Version 1809", "versions": [{"status": "affected", "version": "10.0.17763.0", "lessThan": "10.0.17763.9376", "versionType": "custom"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2016", "versions": [{"status": "affected", "version": "10.0.14393.0", "lessThan": "10.0.14393.9612", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "versions": [{"status": "affected", "version": "10.0.14393.0", "lessThan": "10.0.14393.9612", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2019", "versions": [{"status": "affected", "version": "10.0.17763.0", "lessThan": "10.0.17763.9376", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "versions": [{"status": "affected", "version": "10.0.17763.0", "lessThan": "10.0.17763.9376", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2022", "versions": [{"status": "affected", "version": "10.0.20348.0", "lessThan": "10.0.20348.5761", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2025", "versions": [{"status": "affected", "version": "10.0.26100.0", "lessThan": "10.0.26100.33650", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "versions": [{"status": "affected", "version": "10.0.26100.0", "lessThan": "10.0.26100.33650", "versionType": "custom"}], "platforms": ["x64-based Systems"]}]}], "published": "2026-10-13T19:20:09.393", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83674", "tags": ["Vendor Advisory", "Patch"], "source": "secure@microsoft.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secure@microsoft.com", "description": [{"lang": "en", "value": "CWE-1390"}]}], "descriptions": [{"lang": "en", "value": "Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network."}], "lastModified": "2026-10-29T20:51:14.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "1F4158F1-A617-466F-BBC1-B4272D5A2E45", "versionEndExcluding": "10.0.14393.9612"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "AE808C08-3E9C-49D4-A3B5-0E3EC438543A", "versionEndExcluding": "10.0.14393.9612"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "15BDFD52-C4C7-440A-B97C-D7637E77AFAC", "versionEndExcluding": "10.0.17763.9376"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "A1A74FEC-9922-4060-A2C0-06080FB4DDA8", "versionEndExcluding": "10.0.17763.9376"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98478576-8FD0-48B8-91CD-0EA3379DE644", "versionEndExcluding": "10.0.14393.9612"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A35F3B3-7038-4745-981E-500054E3B406", "versionEndExcluding": "10.0.17763.9376"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "A98E694F-9390-488A-A7FB-3E7BF7E988F8", "versionEndExcluding": "10.0.20348.5761"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "D95E80FE-F34C-4805-9A66-75D090E65BBB", "versionEndExcluding": "10.0.26100.33650"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}