New Spoofing CVEs Emerge as Microsoft Enforces DKM Hardening for AD FS

• •Two new spoofing vulnerabilities (CVE-2026-108131 and CVE-2026-96222) were disclosed on October 13, 2026.
• •The vulnerabilities exploit weaknesses in AD FS, which is critical for federated identity management.
• •Microsoft's DKM hardening was activated the same day, but the new CVEs reopen previously secured attack surfaces.

On October 13, 2026, Microsoft activated enforcement for the Distributed Key Manager (DKM) access control list (ACL) in Active Directory Federation Services (AD FS), aimed at mitigating vulnerabilities. However, the same day, two new spoofing vulnerabilities were disclosed: CVE-2026-108131 (token forgery) and CVE-2026-96222 (bypass), both rated as high severity. These vulnerabilities exploit weaknesses in the trust boundary that DKM enforcement was intended to secure. The DKM hardening process was initially introduced in audit mode on July 14, 2026, and is now the default setting for most enterprise environments. The vulnerabilities do not require privileged access to exploit, potentially affecting all federated sessions relying on AD FS. Microsoft has not confirmed any exploitation of these vulnerabilities at the time of disclosure. Organizations using AD FS are advised to apply the latest patches and verify DKM ACL enforcement is active on all nodes.