Network Policy Server EUVD-2026-100336

Requires network reachability to the Windows Network Policy Server (NPS) role, which operates as the RADIUS server handling authentication requests (e.g., for 802.1X, VPN, and wireless access). Exploitation targets the request-parsing path that contains the heap overflow; per CVSS PR:N/UI:N/AC:L, no authentication, user interaction, or non-default configuration is indicated as required beyond having the NPS role installed and reachable. The primary limiting factor is exposure: NPS is typically reachable only from internal or authentication-facing network segments rather than the public internet, so network segmentation and restricting RADIUS traffic to trusted clients materially reduce realistic attack surface. Exact vulnerable versions and whether specific NPS configurations are needed are not confirmed from the available data.

All available signals point to a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes pre-authentication, low-complexity remote code execution requiring no user interaction, and the CWE-122 heap-based buffer overflow in a network-facing authentication service is consistent with that vector - there is no network-vector-versus-local-access contradiction here. However, several corroborating signals are MISSING, not negative: no EPSS probability was provided, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is currently no public exploit identified at time of analysis. The absence of these signals does not lower the intrinsic severity; given NPS's role as a RADIUS/network-authentication server typically exposed to network segments, a reliable heap-overflow RCE here would be attractive for weaponization even though exploitation has not yet been observed. Treat as high priority for patching while recognizing that real-world exploitation activity is unconfirmed.

A remote, unauthenticated attacker with network reachability to the NPS/RADIUS service sends a specially crafted request that overflows a heap buffer during parsing, corrupting memory to achieve arbitrary code execution in the context of the NPS service. Because CVSS indicates AC:L and PR:N/UI:N, no credentials, user interaction, or complex preconditions are needed. No public exploit code is referenced at this time, so exploitation would currently require independent exploit development.