MSRC-CVE-2025-59258 — Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What type of information could be disclosed by this vulnerability?
An attacker who successfully exploited this vulnerability could obtain Single Sign-On (SSO) cookies in ADFS logs.

Security updates
10.0.17763.7919 — https://support.microsoft.com/help/5066586
10.0.20348.4294 — https://support.microsoft.com/help/5066782
10.0.26100.6899 — https://support.microsoft.com/help/5066835
10.0.25398.1913 — https://support.microsoft.com/help/5066780
10.0.14393.8519 — https://support.microsoft.com/help/5066836
6.2.9200.25722 — https://support.microsoft.com/help/5066875
6.3.9600.22824 — https://support.microsoft.com/help/5066873

Vulnerabilities 1

Medium 6.2

CVE-2025-59258

Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability

Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally.

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows

Oct 14, 2025

Revision history

2025-10-14 #1
Information published.

References

CVE-2025-59258 Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59258
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss