CVE-2021-41361 is a spoofing vulnerability affecting Active Directory Federation Services (AD FS) on Microsoft Windows Server 2016, 2019, and 2022. With a CVSS score of 5.4 (MEDIUM), it requires low privileges and user interaction, allowing an attacker to achieve limited confidentiality and integrity impact. There is no public exploit code available, it is not on CISA's KEV catalog, and community discussion and media coverage are minimal, indicating low current exploitation risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | ||
20h2CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:* | ||
2004CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.