This vulnerability (CVE-2026-50684) affects Microsoft Windows 10 Version 1607, specifically the Active Directory Federation Services component. It is caused by improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). An attacker with authorized access can exploit this flaw to perform spoofing attacks over a network. The CVSS 3.1 base score is 4.8, reflecting a medium severity with network attack vector, low complexity, required privileges, and user interaction. Microsoft has released an official fix to address this issue.

Successful exploitation allows an authorized attacker to perform spoofing attacks, potentially misleading users or systems by injecting malicious scripts into web pages generated by AD FS. The impact includes limited confidentiality and integrity loss but no availability impact. This could lead to unauthorized actions or information disclosure within the scope of the authorized user's privileges.

An official fix is available from Microsoft. Users and administrators should apply the provided security update as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50684 to remediate this vulnerability.