CVE-2026-97788High· 7.5▾ TwilightObservable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
0.7% → 0.9%
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
windows_10_1607 < 10.0.14393.9612windows_10_1809 < 10.0.17763.9376windows_10_21h2 < 10.0.19044.7807windows_10_22h2 < 10.0.19045.7807windows_11_23h2 < 10.0.22631.7652windows_11_24h2 < 10.0.26100.9711windows_11_25h2 < 10.0.26200.9711windows_11_26h1 < 10.0.28000.3231windows_11_26h2 < 10.0.26300.9711windows_server_2012windows_server_2012 = r2windows_server_2016 < 10.0.14393.9612windows_server_2019 < 10.0.17763.9376windows_server_2022 < 10.0.20348.5761windows_server_2025 < 10.0.26100.33650.net_framework = 4.8.1.net_framework = 4.8.net_framework = 4.6.2.net_framework = 4.7.net_framework = 4.7.1.net_framework = 4.7.2.net_framework = 3.5Upgrade past the affected range:
windows_10_1607 10.0.14393.9612windows_10_1809 10.0.17763.9376windows_10_21h2 10.0.19044.7807windows_10_22h2 10.0.19045.7807windows_11_23h2 10.0.22631.7652windows_11_24h2 10.0.26100.9711windows_11_25h2 10.0.26200.9711windows_11_26h1 10.0.28000.3231windows_11_26h2 10.0.26300.9711windows_server_2016 10.0.14393.9612windows_server_2019 10.0.17763.9376windows_server_2022 10.0.20348.5761windows_server_2025 10.0.26100.33650Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97782Medium· 6.8Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
CVE-2026-32226Medium· 5.9Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50659Medium· 6.5Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
CVE-2020-1066High· 7.8An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level. To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malic…
CVE-2026-62765High· 7.5Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-83831High· 8.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability