CVE-2018-8326

CVE-2018-8326 describes a cross-site scripting (XSS) vulnerability within open-source customizations for Microsoft Active Directory Federation Services (AD FS), specifically impacting "Web Customizations." This medium-severity vulnerability (CVSS 5.4) can be exploited with low attack complexity by an authenticated attacker, requiring user interaction, to achieve limited confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog, though it garnered minimal community discussion and media coverage at the time of its disclosure.