Security October 2026 CVE-2026-83674
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Severity Important
CVSS base score 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact Spoofing
EPSS, next 30 days 0.7% Higher than 53.9% of scored CVEs · FIRST model run 25 Oct 2026 · about EPSS
Public exploit code No Nuclei template lists it
Exploitability Exploitation Unlikely
Publicly disclosed No
Customer action Required: apply the update
Component Active Directory Federation Services (AD FS)
Weakness CWE-1390: Weak Authentication
Issued by Microsoft
Last revised 13 Oct 2026 CVSS 3.1 base metrics Red raises the risk · green lowers it
Attack vector NetworkAV:N
Attack complexity HighAC:H
Privileges required NonePR:N
User interaction NoneUI:N
Scope UnchangedS:U
Confidentiality HighC:H
Integrity HighI:H
Availability HighA:H Source. This summary comes from MSRC's public CVRF document for October 2026. If the MSRC page is blocked in your browser, the NVD and CVE.org records carry the same identifier. None of this says whether your devices are affected.
Explore global source statements, affected packages and advisory history for CVE-2026-83674 . The catalog has a separate collection scope from Microsoft release records.
Overview Affected History Connections
cve-program · CVE-2026-83674 Published Windows 10 Version 1607 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 10 Version 1607",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9612",
"versionType": "custom",
"status": "affected"
}
]
} Windows 10 Version 1809 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 10 Version 1809",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9376",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2016 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2016",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9612",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2016 (Server Core installation) Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2016 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9612",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2019 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2019",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9376",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2019 (Server Core installation) Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2019 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9376",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2022 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2022",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.20348.0",
"lessThan": "10.0.20348.5761",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2025 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2025",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33650",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2025 (Server Core installation) Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2025 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33650",
"versionType": "custom",
"status": "affected"
}
]
}