Network Policy Server CVE-2026-85811

Exploitation requires the target to have the Network Policy Server (NPS) role installed and reachable - i.e. a Windows Server acting as a RADIUS/NAC authentication server; hosts without NPS enabled are not exploitable. The attacker must be positioned on an adjacent network (AV:A): same Layer-2 segment, VLAN, or logically adjacent network reachable by the RADIUS/authentication protocol, not the open internet. No credentials (PR:N) and no user interaction (UI:N) are needed. The principal limiting factor is High attack complexity (AC:H): reliably triggering and weaponizing the use-after-free requires winning a race/timing window and controlling heap state, which constrains real-world exploitation despite the lack of authentication.

Signals are mixed and point to a serious-but-not-emergency priority. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes an unauthenticated memory-corruption flaw with total confidentiality, integrity and availability impact, which aligns with CISA's SSVC Technical Impact of 'total'. However, exploitability signals temper this: the attack vector is Adjacent (AV:A), not Network, so the attacker must already hold a foothold on the same logical network segment, and Attack Complexity is High (AC:H), consistent with the difficulty of reliably winning the race/heap conditions needed to exploit a use-after-free (CWE-416). SSVC reinforces the lower-urgency read: Exploitation=none (no observed or public exploitation) and Automatable=no (cannot be reliably mass-exploited). No CISA KEV listing and no public POC were provided, and no EPSS score was supplied, so probabilistic exploitation data is simply missing rather than low. In short, this is a high-impact flaw whose real-world risk is bounded by the adjacent-only vector, high complexity, and absence of any confirmed exploitation - a strong patch priority for environments running the NPS/RADIUS role, but not a drop-everything internet-facing emergency.

An attacker who already has a presence on a network segment adjacent to a Windows Server running the Network Policy Server (RADIUS) role sends specially crafted authentication traffic to the NPS service, triggering a use-after-free condition. By grooming the heap and winning the required timing window, the attacker corrupts memory to achieve arbitrary code execution in the context of the NPS service without any credentials or user interaction. No public exploit code was identified at time of analysis, and the High attack complexity means a working exploit would require significant reliability engineering.