Network Policy Server CVE-2026-50496

Exploitation requires network reachability to a Windows host running the Network Policy Server role with the SNMP handling component active/exposed - the affected feature is NPS SNMP processing specifically, so hosts without the NPS role or without SNMP exposed are not reachable via this path. The CVSS vector is AV:N/AC:L/PR:N/UI:N (no authentication, no user interaction, low complexity), so where the SNMP endpoint is reachable there are no additional special prerequisites; the primary limiting factor is exposure of the NPS SNMP service to the attacker's network position and whether SNMP (typically UDP 161/162) is filtered by firewalls.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 and describes a network-reachable, low-complexity, unauthenticated flaw - favorable conditions for an attacker. However, there is a material conflict in the input: the description and tags characterize this as 'Information Disclosure,' yet the vector sets C:N/I:N/A:H, which models a denial-of-service (availability) impact, not confidentiality loss. For a genuine information-disclosure OOB read, one would expect a confidentiality impact (C:L/C:H) rather than A:H - this discrepancy should be verified against the Microsoft advisory before finalizing severity interpretation. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no POC is referenced, so this is not an urgent active-exploitation scenario; realistic risk is moderate - a network-facing unauthenticated flaw worth prompt patching, but without evidence of weaponization.

A remote attacker with network access to a Windows Server running the Network Policy Server role sends a crafted SNMP request that triggers the out-of-bounds read, causing the service to return or process memory beyond the intended buffer. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required, making the attack straightforward against any exposed NPS/SNMP endpoint. No public exploit code is identified at time of analysis, so exploitation would currently require custom development.