CVE-2026-97788
7.5HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-203
Impact
Unauthenticated network attackers can extract sensitive information from AD FS via side-channel timing or response differences. They only need network access to the exposed AD FS endpoint.
Root cause
An observable timing or behavioral discrepancy (CWE-203) in request handling leaks data to unauthorized callers.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Check the Microsoft MSRC advisory (CVE-2026-97788) for the specific Windows Server update and install it immediately. If patching must wait, restrict network access to the AD FS endpoints via firewall rules or reverse proxy controls.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.