Network Policy Server CVE-2026-85371

Exploitation requires the target Windows Server to have the Network Policy Server (NPS) role installed and reachable - NPS is Microsoft's RADIUS implementation used for 802.1X, VPN, and network access authentication, and it is NOT enabled by default on a base Windows installation, which meaningfully limits the exposed population. Although CVSS is AV:N/PR:N/UI:N (unauthenticated, remote, no user interaction), the AC:H metric combined with the use-after-free class means the attacker must reliably trigger a memory-state race condition, so exploitation is not a simple single-shot request and is non-automatable per SSVC. Patching to the fixed build for the specific Windows/Windows Server version listed in the EUVD data removes the condition.

Signals point to a serious-but-not-emergency vulnerability. The CVSS 3.1 score of 8.1 is driven by an attacker-favorable exposure (AV:N network vector, PR:N no privileges, UI:N no user interaction) combined with total impact (C:H/I:H/A:H), but it is explicitly tempered by AC:H - high attack complexity, consistent with a use-after-free (CWE-416) that typically requires winning a memory-state race. The CISA SSVC decision framework reinforces a lower real-world urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited, matching AC:H), while Technical Impact=total (matching code execution). There is no CISA KEV listing and no POC reported, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so the probabilistic exploitation likelihood cannot be factored in - this is a genuine data gap. Taken together, this is a legitimate patch-soon priority because of unauthenticated network-reachable RCE potential, but the high complexity, non-automatable nature, and absence of any exploitation signal argue against treating it as an active-threat emergency. Verify your environment actually runs the NPS role before prioritizing.

An attacker with network reach to a Windows Server running the Network Policy Server (RADIUS) role sends specially crafted authentication/accounting traffic designed to trigger the use-after-free condition in NPS. By repeatedly manipulating request timing to win the underlying race, the attacker corrupts freed memory and achieves arbitrary code execution on the server without authentication or user interaction. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation is non-trivial.