EUVD-2026-99511
GHSA-v597-8749-g479
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach NPS RADIUS listener over network
-
DeliverySend crafted authentication/accounting packets
-
ExploitTrigger use-after-free in request handling
-
ExecutionGroom heap and win race
-
ImpactExecute arbitrary code in service context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Windows Server have the Network Policy Server (NPS) role installed and reachable on the network - NPS is Microsoft's RADIUS/NAC/802.1X server, so only hosts actively serving RADIUS authentication are vulnerable; systems without the NPS role are not exposed. Per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed. The principal limiting factor is AC:H: the use-after-free almost certainly depends on winning a race condition or achieving a precise memory/heap state, reducing reliability and likely requiring repeated attempts rather than a single deterministic request. |
| Impact | This is a credible high-priority vulnerability but short of a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw requiring no user interaction, with full C:H/I:H/A:H impact - consistent with remote code execution via use-after-free (CWE-416) in a RADIUS-facing service. The single tempering signal is AC:H, which for a UAF almost always reflects a race/timing or heap-grooming requirement that makes reliable weaponization non-trivial; this is why the score lands at 8.1 rather than 9.8. No EPSS score, CISA KEV entry, or public POC is present in the provided data, so there is no evidence of active exploitation or available exploit code at this time - the risk is currently theoretical-but-serious rather than demonstrated. Note a minor conflict in the input: the Tags include 'Denial Of Service,' yet the description and the C:H/I:H impact metrics describe code execution, not merely a crash; the RCE framing should be treated as authoritative. Overall: patch promptly on internet- or network-facing NPS servers, but AC:H plus absent exploitation signals argue against panic-level urgency. |
| Exploit ScenarioDerived | An attacker with network reach to a Windows Server running the Network Policy Server (RADIUS) role sends specially crafted authentication/accounting traffic that triggers a use-after-free in NPS request handling, corrupting memory to execute arbitrary code in the service context. No credentials or user interaction are required, but the AC:H rating implies the attacker must win a race condition or achieve specific heap state, so exploitation may require multiple attempts. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.
RemediationAI
Patch available per vendor advisory: Microsoft has published fixes for CVE-2026-85799 in its update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85799), and the EUVD build thresholds define the remediated level for each branch - for example Windows Server 2019 and Windows 10 1809 at 10.0.17763.9376 or later, Server 2016/Windows 10 1607 at 10.0.14393.9612 or later, Server 2022 at 10.0.20348.5761 or later, Server 2025 at 10.0.26100.33650 or later, Server 2012 R2 at 6.3.9600.23470 or later, and Server 2012 at 6.2.9200.26434 or later, with the matching client builds for Windows 10 21H2/22H2 (10.0.19044.7807), Windows 11 23H2 (10.0.22631.7652), 24H2 (10.0.26100.9711), 25H2 (10.0.26200.9711), 26H1 (10.0.28000.3231) and 26H2 (10.0.26300.9711); apply the appropriate cumulative update and confirm the installed build equals or exceeds these values, since there is no separate NPS package to upgrade. Where patching must be staged, the most effective compensating control is network scoping of the RADIUS service: restrict inbound UDP 1812/1813 (and legacy 1645/1646) to the specific, known IP addresses of legitimate RADIUS clients and proxies using host firewall rules or an upstream ACL, which removes the unauthenticated exposure path but breaks any unlisted authenticator, so inventory all NAS/VPN/802.1X clients first and expect authentication failures if the list is incomplete. If the NPS role is not actually required on a given server, removing or disabling it eliminates the attack surface entirely - with the trade-off that RADIUS/VPN/802.1X authentication served by that host must be relocated. Segmenting NPS hosts into a dedicated management VLAN reachable only from network infrastructure, and monitoring for repeated malformed or unexpected RADIUS requests that could indicate exploitation attempts against the racy use-after-free condition, provide additional depth but should be treated as temporary measures rather than substitutes for the vendor update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a use-after-free (CWE-416), a memory-safety class in which an object is freed while a reference to it remains live and is subsequently dereferenced, allowing an attacker to influence the contents of the reclaimed allocation and corrupt control data - here in a network-facing service, which is why the impact vector reaches code execution and why Microsoft's tags also flag memory corruption and denial-of-service effects. NPS is the Windows Server role that implements RADIUS authentication/authorization/accounting and Network Access Protection/802.1X policy evaluation, so the vulnerable parsing and request-handling paths are reachable by anyone who can send RADIUS traffic to the host on the standard ports (UDP 1812/1813, and legacy 1645/1646). CPE and EUVD data map the affected code to the core Windows Server builds rather than a standalone NPS package, because NPS is an optional role shipped within the operating system image; consequently the same binary fix is distributed through the monthly cumulative updates for each supported Windows Server and Windows client servicing branch. The assessed AC:H component is consistent with the memory-management nature of the bug: reliable exploitation generally requires heap grooming and timing control over the freed object rather than a single deterministic packet.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable RADIUS service exploitable without auth or interaction (AV:N/PR:N/UI:N); AC:H reflects the race/heap conditions typical of a use-after-free, with full RCE impact C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft's Network Policy Server (NPS) role on Windows Server is affected by a high-severity unauthenticated remote code execution vulnerability (CVE-2026-85799), exposing only network-reachable servers that have this role installed. Because NPS supports RADIUS, NAC, and 802.1X network access functions, a compromised server could disrupt or bypass authentication controls for dependent network segments. Leadership should prioritize patching all exposed NPS hosts, though the high attack complexity and absence of identified public exploit code make this urgent rather than an immediate crisis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB