NetSight
IP …
medium4.8

CVE-2026-50684

Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services (AD FS) allows an authorized attac…

Impact

Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.

Affected products

VendorProductAffected versions
MicrosoftWindows 10 1607
before 10.0.14393.9339
MicrosoftWindows 10 1809
before 10.0.17763.9020
MicrosoftWindows Server 2012
All versions
Version r2
MicrosoftWindows Server 2016
before 10.0.14393.9339
MicrosoftWindows Server 2019
before 10.0.17763.9020
MicrosoftWindows Server 2022
before 10.0.20348.5386
MicrosoftWindows Server 2025
before 10.0.26100.33158
MicrosoftWindows 10 Version 1607
from 10.0.14393.0 before 10.0.14393.9339
MicrosoftWindows 10 Version 1809
from 10.0.17763.0 before 10.0.17763.9020
MicrosoftWindows Server 2012
from 6.2.9200.0 before 6.2.9200.26226
MicrosoftWindows Server 2012 (Server Core Installation)
from 6.2.9200.0 before 6.2.9200.26226
MicrosoftWindows Server 2012 R2
from 6.3.9600.0 before 6.3.9600.23291
MicrosoftWindows Server 2012 R2 (Server Core Installation)
from 6.3.9600.0 before 6.3.9600.23291
MicrosoftWindows Server 2016
from 10.0.14393.0 before 10.0.14393.9339
MicrosoftWindows Server 2016 (Server Core Installation)
from 10.0.14393.0 before 10.0.14393.9339
MicrosoftWindows Server 2019
from 10.0.17763.0 before 10.0.17763.9020
MicrosoftWindows Server 2019 (Server Core Installation)
from 10.0.17763.0 before 10.0.17763.9020
MicrosoftWindows Server 2022
from 10.0.20348.0 before 10.0.20348.5386
MicrosoftWindows Server 2025
from 10.0.26100.0 before 10.0.26100.33158
MicrosoftWindows Server 2025 (Server Core Installation)
from 10.0.26100.0 before 10.0.26100.33158

Weakness classification

CWE-79

References