CVE-2018-16794: Microsoft Active Directory Federation Services

High severity, CVSS 8.6. EPSS: 8% chance of exploitation in the next 30 days.

Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.

Affected products

• Microsoft Active Directory Federation Services: up to and including 4.0

Published 2018-09-18. Last modified 2026-06-17.