Medium severity6.5NVD Advisory· Published Aug 15, 2018· Updated Jun 17, 2026

CVE-2018-8340

Description

A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor authentication requests, aka "AD FS Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows Server 2012 R2, Windows 10 Servers.

Affected products

Microsoft/Windows Server 20122 versions
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
- (no CPE)range: (Server Core installation)
Microsoft/Windows Server 20164 versions
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*
- (no CPE)range: (Server Core installation)
Microsoft/Active Directory Federation Servicesllm-fuzzy
Microsoft/Windows Server 2003cpe-rescue
Range: version 1709 (Server Core Installation)

Patches

Vulnerability mechanics

References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8340nvdPatchVendor Advisory
www.securityfocus.com/bid/105029nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1041474nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000