Network Policy Server CVE-2026-85806

Exploitation requires the target Windows Server to have the Network Policy Server (NPS) role installed and reachable on the network (typically serving RADIUS authentication/authorization on UDP 1812/1813 or 1645/1646), since NPS is an optional role rather than a default-enabled service. Where NPS is deployed and network-exposed, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity are needed. The primary limiting factor is deployment scope: servers without the NPS role are unaffected, and restricting RADIUS reachability to trusted network access clients (NASes/switches/VPNs) materially reduces the exposed attack surface. Affected builds span Windows Server 2012 through 2025 and Windows 10/11, each fixed at the specific build numbers listed in the EUVD data.

All provided signals point to a genuinely high-priority vulnerability, though with an important scoping caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with no user interaction, and the integer-underflow-to-buffer-overflow mechanism (CWE-121, tagged Stack Overflow) yielding code execution supports the 9.8 Critical rating with full C:H/I:H/A:H impact. This is reported directly by Microsoft (secure@microsoft.com) and a patch is available, which confirms the technical validity of the finding. However, key real-world risk signals are MISSING from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no POC/exploit-code indicator provided - so the exploitation status is 'no public exploit identified at time of analysis.' The high CVSS therefore reflects theoretical worst-case impact, not demonstrated in-the-wild activity. A critical mitigating factor the raw score does not capture: NPS (Network Policy Server) is an optional Windows Server role, not a default-enabled service, so the true exposed population is only hosts where the NPS/RADIUS role is installed and network-reachable. Net: treat as a priority patch for any RADIUS/NPS infrastructure (which is often security-sensitive AAA plumbing), but the absence of EPSS/KEV/POC signals means widespread active exploitation is not currently evidenced.

An attacker with network reachability to a Windows Server running the NPS (RADIUS) role sends a crafted RADIUS/authentication request whose length or count field triggers an integer underflow, wrapping to an undersized allocation and overflowing a stack buffer. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires no authentication or user interaction, allowing the attacker to corrupt memory and execute code in the context of the NPS service. No public exploit code is identified in the provided data, so weaponization effort is presently unknown.