EUVD-2026-99776
GHSA-rh36-5j8c-xf95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach NDES endpoint over network
-
DeliverySend crafted enrollment request
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionCrash NDES service
-
ImpactDeny certificate enrollment
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Windows server has the Network Device Enrollment Service (NDES) role of Active Directory Certificate Services (AD CS) installed and network-reachable - NDES is an optional, deliberately deployed role (typically for SCEP-based certificate enrollment of network devices and MDM), not a default-enabled component, which is the primary factor limiting exposure. Where NDES IS deployed, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low attack complexity are needed, so any attacker able to reach the NDES HTTP endpoint can attempt the crash. Impact is limited to denial of service of the enrollment service; there is no code execution or data disclosure. |
| Impact | This is a genuine but bounded availability risk, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated out-of-bounds read (CWE-125) that an attacker triggers to crash the Network Device Enrollment Service (NDES), producing denial of service with zero confidentiality or integrity impact (C:N/I:N). No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. The main caveat is a signal conflict in the metadata: the input Tags include 'Information Disclosure,' which contradicts the authoritative CVSS impact metrics (C:N) - the vulnerability is a DoS, not a data-exposure issue, so the tag should not drive prioritization. Overall, treat this as a standard-priority availability patch for environments that actually run the NDES role, rather than a drop-everything critical. |
| Exploit ScenarioDerived | An attacker with network reachability to a Windows server hosting the NDES role endpoint sends a crafted enrollment/SCEP request that drives the service to read past the bounds of an allocated buffer, causing the service to crash. Because no authentication or user interaction is required (PR:N/UI:N), repeated requests can keep NDES unavailable, disrupting certificate enrollment for dependent network devices. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds read in the Network Device Enrollment Service (NDES) role of Active Directory Certificate Services allows an unauthenticated remote attacker to crash the SCEP enrollment endpoint on affected Windows servers, producing a denial of service (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only hosts where the optional NDES role is installed and reachable over the network are exposed, spanning Windows Server 2012 through Windows Server 2025 plus Windows 10 versions 1607 and 1809, and Microsoft has published vendor fixes for these builds. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and real-world exposure is bounded because NDES is a deliberately deployed, non-default role rather than a component present on every Windows server.
RemediationAI
Apply the Microsoft security update for CVE-2026-96866 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96866, which brings affected systems to the fixed builds Server 2012 6.2.9200.26434, Server 2012 R2 6.3.9600.23470, Server 2016/Windows 10 1607 10.0.14393.9612, Server 2019/Windows 10 1809 10.0.17763.9376, Server 2022 10.0.20348.5761 and Server 2025 10.0.26100.33650; vendor patch is available and no public exploit code was identified, so standard patch-cycle prioritization is appropriate for internet-facing NDES hosts. Where patching cannot be completed immediately, the most effective compensating control is to stop exposing the NDES endpoint (typically the SCEP virtual directory on IIS over ports 80/443) to untrusted networks, restricting it by firewall rules or IIS IP address and domain restrictions to the management subnets and device ranges that legitimately enrol certificates - the trade-off is that network devices and MDM clients outside those ranges will fail to enroll or renew certificates. If NDES is not actively used, removing the role eliminates the attack surface entirely, at the cost of losing SCEP-based enrollment until it is reinstalled. Placing the endpoint behind an authenticating reverse proxy or WAF that rejects malformed SCEP/CSR payloads can reduce exposure, but many SCEP clients cannot present credentials, so this may break enrollment and should be tested before rollout; none of these workarounds address the underlying memory-safety defect, so the vendor update remains the required fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NDES is the Microsoft implementation of the Simple Certificate Enrollment Protocol (SCEP) and is delivered as an optional role of Active Directory Certificate Services, typically hosted on IIS and reached over HTTP/HTTPS at the /certsrv/mscep/ endpoints. The service parses attacker-supplied enrollment material such as PKCS#10 certificate requests, PKCS#7/CMS messages and GetCACert/GetCACaps queries. The flaw is an out-of-bounds read (CWE-125), meaning the code reads past the end of an allocated buffer while handling a malformed request, which can terminate the worker process and take the enrollment endpoint offline. Per the independent assessment, the outcome is availability-only: the scored vector records no confidentiality or integrity impact and no code execution, so this should not be treated as a memory-disclosure or remote-code-execution primitive even though generic buffer-overflow/information-disclosure tags accompany the record. Triggering it requires no authentication, no user interaction and only low attack complexity, but only where the NDES role is actually installed and its HTTP endpoint is network-reachable.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable NDES endpoint, unauthenticated and low-complexity per description; out-of-bounds read yields only a service crash, so C:N/I:N and A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
Executive ViewAI
An out-of-bounds read in the Network Device Enrollment Service (NDES) role of Microsoft Active Directory Certificate Services allows an unauthenticated remote attacker to crash the SCEP enrollment endpoint on affected Windows servers, taking that service offline. Exposure is limited to hosts where the optional NDES role has been deliberately installed and is reachable over the network (Windows Server 2012 through 2025, plus Windows 10 1607/1809); because the role is non-default, the number of impacted systems is likely small but can include certificate infrastructure that other business services depend on. Leadership should care because a successful attack can stall device and user certificate enrollment, disrupting onboarding, VPN, and identity workflows until the service is restored - though Microsoft has released fixes and no public exploit or confirmed active exploitation was identified at the time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB