Vulnerability · Published Oct 13, 2026 · Assigned by microsoft

CVE-2026-96222Active Directory Federation Services (AD FS) Spoofing Vulnerability

High 7.4

In plain English

A high-severity improper certificate validation in Microsoft .NET Framework 3.5 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.6%top 51.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:10	aspnetcore-runtime-8.0	8.0.32-1.el10_2	ALSA-2026:86168
AlmaLinux:8	aspnetcore-runtime-8.0	8.0.32-2.el8_10	ALSA-2026:86594
AlmaLinux:9	aspnetcore-runtime-8.0	8.0.32-1.el9_8	ALSA-2026:86169
AlmaLinux:10	aspnetcore-runtime-dbg-8.0	8.0.32-1.el10_2	ALSA-2026:86168
AlmaLinux:8	aspnetcore-runtime-dbg-8.0	8.0.32-2.el8_10	ALSA-2026:86594
AlmaLinux:9	aspnetcore-runtime-dbg-8.0	8.0.32-1.el9_8	ALSA-2026:86169
AlmaLinux:10	aspnetcore-targeting-pack-8.0	8.0.32-1.el10_2	ALSA-2026:86168
AlmaLinux:8	aspnetcore-targeting-pack-8.0	8.0.32-2.el8_10	ALSA-2026:86594
AlmaLinux:9	aspnetcore-targeting-pack-8.0	8.0.32-1.el9_8	ALSA-2026:86169
AlmaLinux:10	dotnet-apphost-pack-8.0	8.0.32-1.el10_2	ALSA-2026:86168
AlmaLinux:8	dotnet-apphost-pack-8.0	8.0.32-2.el8_10	ALSA-2026:86594
AlmaLinux:9	dotnet-apphost-pack-8.0	8.0.32-1.el9_8	ALSA-2026:86169
AlmaLinux:10	dotnet-hostfxr-8.0	8.0.32-1.el10_2	ALSA-2026:86168
AlmaLinux:8	dotnet-hostfxr-8.0	8.0.32-2.el8_10	ALSA-2026:86594
AlmaLinux:9	dotnet-hostfxr-8.0	8.0.32-1.el9_8	ALSA-2026:86169
AlmaLinux:10	dotnet-runtime-8.0	8.0.32-1.el10_2	ALSA-2026:86168
AlmaLinux:8	dotnet-runtime-8.0	8.0.32-2.el8_10	ALSA-2026:86594
AlmaLinux:9	dotnet-runtime-8.0	8.0.32-1.el9_8	ALSA-2026:86169
AlmaLinux:10	dotnet-runtime-dbg-8.0	8.0.32-1.el10_2	ALSA-2026:86168
AlmaLinux:8	dotnet-runtime-dbg-8.0	8.0.32-2.el8_10	ALSA-2026:86594
AlmaLinux:9	dotnet-runtime-dbg-8.0	8.0.32-1.el9_8	ALSA-2026:86169
AlmaLinux:10	dotnet-sdk-8.0	8.0.132-1.el10_2	ALSA-2026:86168
AlmaLinux:8	dotnet-sdk-8.0	8.0.132-2.el8_10	ALSA-2026:86594
AlmaLinux:9	dotnet-sdk-8.0	8.0.132-1.el9_8	ALSA-2026:86169
AlmaLinux:10	dotnet-sdk-8.0-source-built-artifacts	8.0.132-1.el10_2	ALSA-2026:86168
AlmaLinux:8	dotnet-sdk-8.0-source-built-artifacts	8.0.132-2.el8_10	ALSA-2026:86594
AlmaLinux:9	dotnet-sdk-8.0-source-built-artifacts	8.0.132-1.el9_8	ALSA-2026:86169
AlmaLinux:10	dotnet-sdk-dbg-8.0	8.0.132-1.el10_2	ALSA-2026:86168
AlmaLinux:8	dotnet-sdk-dbg-8.0	8.0.132-2.el8_10	ALSA-2026:86594
AlmaLinux:9	dotnet-sdk-dbg-8.0	8.0.132-1.el9_8	ALSA-2026:86169
AlmaLinux:10	dotnet-targeting-pack-8.0	8.0.32-1.el10_2	ALSA-2026:86168
AlmaLinux:8	dotnet-targeting-pack-8.0	8.0.32-2.el8_10	ALSA-2026:86594
AlmaLinux:9	dotnet-targeting-pack-8.0	8.0.32-1.el9_8	ALSA-2026:86169
AlmaLinux:10	dotnet-templates-8.0	8.0.132-1.el10_2	ALSA-2026:86168
AlmaLinux:8	dotnet-templates-8.0	8.0.132-2.el8_10	ALSA-2026:86594
AlmaLinux:9	dotnet-templates-8.0	8.0.132-1.el9_8	ALSA-2026:86169
Alpine:v3.22	dotnet8-runtime	8.0.32-r0	ALPINE-CVE-2026-96222
Alpine:v3.23	dotnet8-runtime	8.0.32-r0	ALPINE-CVE-2026-96222
Alpine:v3.24	dotnet8-runtime	8.0.32-r0	ALPINE-CVE-2026-96222
NuGet	system.security.cryptography.xml	8.0.5	GHSA-vrv5-2jg9-4mmr
Rocky Linux:10	dotnet8.0	0:8.0.132-1.el10_2	RLSA-2026:86168
Rocky Linux:8	dotnet8.0	0:8.0.132-2.el8_10	RLSA-2026:86594
Rocky Linux:9	dotnet8.0	0:8.0.132-1.el9_8	RLSA-2026:86169
Ubuntu:24.04:LTS	dotnet10	10.0.113-10.0.13-0ubuntu1~24.04.1	USN-8942-1
Ubuntu:26.04:LTS	dotnet10	10.0.113-10.0.13-0ubuntu1~26.04.1	USN-8942-1
Ubuntu:26.10	dotnet10	10.0.113-10.0.13-0ubuntu1~26.10.1	USN-8942-1
Ubuntu:26.10	dotnet11	11.0.100-11.0.0~rc2-0ubuntu1~26.10.1	USN-8942-1
Ubuntu:22.04:LTS	dotnet6	no fix listed	UBUNTU-CVE-2026-96222
Ubuntu:22.04:LTS	dotnet7	no fix listed	UBUNTU-CVE-2026-96222
Ubuntu:22.04:LTS	dotnet8	8.0.132-8.0.32-0ubuntu1~22.04.1	USN-8942-1
Ubuntu:22.04:LTS	dotnet8	8.0.132-8.0.32-0ubuntu1~22.04.1	UBUNTU-CVE-2026-96222
Ubuntu:24.04:LTS	dotnet8	8.0.132-8.0.32-0ubuntu1~24.04.1	USN-8942-1
Ubuntu:24.04:LTS	dotnet8	8.0.132-8.0.32-0ubuntu1~24.04.1	UBUNTU-CVE-2026-96222

Affected products (as reported)

Vendor	Product	Versions
Microsoft	Microsoft .NET Framework 3.5	3.5.0 – before 2.0.50727.9188 AND 3.0.30729.9171
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2	3.0.0.0 – before 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	4.7.0 – before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	4.8.0 – before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	4.8.1 – before 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	4.7.0 – before 4.7.4150.0
Microsoft	Microsoft .NET Framework 4.8	4.8.0 – before 4.8.4811.0
Microsoft	Microsoft .NET Framework 4.8.1	4.8.0.0 – before 4.8.9363.0
Microsoft	Microsoft Visual Studio 2022 version 17.14	17.14.0 – before 17.14.42
Microsoft	Microsoft Visual Studio 2026 version 18.10	18.10.0 – before 18.10.4
Microsoft	System.Security.Cryptography.Xml	10.0.0 – before 8.0.5
Microsoft	Windows 10 Version 1607	10.0.14393.0 – before 10.0.14393.9612
Microsoft	Windows 10 Version 1809	10.0.17763.0 – before 10.0.17763.9376
Microsoft	Windows Server 2012 R2	6.3.9600.0 – before 6.3.9600.23470
Microsoft	Windows Server 2012 R2 (Server Core installation)	6.3.9600.0 – before 6.3.9600.23470
Microsoft	Windows Server 2016	10.0.14393.0 – before 10.0.14393.9612
Microsoft	Windows Server 2016 (Server Core installation)	10.0.14393.0 – before 10.0.14393.9612
Microsoft	Windows Server 2019	10.0.17763.0 – before 10.0.17763.9376
Microsoft	Windows Server 2019 (Server Core installation)	10.0.17763.0 – before 10.0.17763.9376
Microsoft	Windows Server 2022	10.0.20348.0 – before 10.0.20348.5761
Microsoft	Windows Server 2025	10.0.26100.0 – before 10.0.26100.33650
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0 – before 10.0.26100.33650

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

References

Active Directory Federation Services (AD FS) Spoofing Vulnerability vendor-advisory, patch