CVE-2026-96222High· 7.4▾ TwilightImproper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
System.Security.Cryptography.Xml >= 8.0.0, <= 8.0.4Patched in:
System.Security.Cryptography.Xml 8.0.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96960High· 7.5Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96958High· 7.5Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96959High· 7.5Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-84008High· 7.5Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2025-14022High· 7.7LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK
CVE-2021-20327Medium· 6.4A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate