AD FS Gets Two New Spoofing CVEs the Day DKM Enforcement Activates — CVE-2026-108131 + CVE-2026-96222
Photo: Pixabay (illustration)
Microsoft’s October 2026 Patch Tuesday shipped fifteen CVEs affecting Active Directory Federation Services . Two arrived as direct spoofing vulnerabilities: CVE-2026-108131 (CVSS 7.5, Important, token forgery) and CVE-2026-96222 (CVSS 7.4, Important, bypass). They arrive the same week that Post 131823 documented DKM ACL enforcement activation — the mechanism Microsoft designed to close the trust-boundary surface these CVEs are now reopening. The timing compounds what we already documented in the Golden SAML analysis (Post 131832). AD FS is the federated identity layer enterprises use to bridge on-premises identity into cloud services.
Source: Forkast
