EUVD-2026-99317
GHSA-x8gj-9h3c-797h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach NPS over network
-
DeliverySend crafted RADIUS request
-
ExploitTrigger out-of-bounds read in NPS
-
ExecutionCrash authentication service
-
ImpactDeny network access service-wide
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target host has the Network Policy Server (NPS) role installed and reachable on the network (typically listening for RADIUS traffic), as NPS is not enabled by default on all Windows editions. Given AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special client-side conditions are needed once NPS is network-reachable. The primary limiting factor is deployment scope: only systems actually running the NPS role are affected, and impact is confined to availability (service crash/DoS) with no code execution or data exposure. |
| Impact | This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a remote, unauthenticated, low-complexity attack requiring no user interaction, with impact limited purely to availability (C:N/I:N) - a network-reachable denial of service against the NPS RADIUS service, consistent with the CWE-125 out-of-bounds read described. The signals partially conflict on urgency: SSVC reports Exploitation=none (no observed exploitation), the CVE is NOT listed in CISA KEV, and no EPSS score or POC was provided, yet SSVC also flags Automatable=yes, meaning an attacker who develops a trigger could reliably script it at scale. On balance this is a real patch-priority item for organizations running NPS as a RADIUS/authentication front-end (loss of NPS can break network authentication, VPN, and 802.1X), but it is not an emergency: there is no confirmed exploitation and no confidentiality/integrity impact. Note a tag/impact conflict: the input tags 'Information Disclosure', but the CVSS (C:N) and description ('deny service') indicate availability impact only - the information-disclosure framing is not supported by the authoritative data and should be disregarded. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a specially crafted RADIUS/network-policy request to an internet- or network-reachable NPS server, triggering an out-of-bounds read that crashes or hangs the service. Because SSVC marks this Automatable=yes, the trigger could be scripted to repeatedly knock the authentication service offline, disrupting VPN, Wi-Fi/802.1X, and other RADIUS-dependent access. No public exploit was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in the Windows Network Policy Server (NPS) role lets unauthenticated remote attackers crash or degrade the service, producing a denial-of-service condition on hosts that expose NPS to the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no credentials, user interaction, or client-side conditions are required once NPS is reachable, and impact is confined to availability - no code execution, integrity, or confidentiality loss. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, though the flaw is rated Automatable: yes and affects a broad set of Windows client and server builds spanning Windows 10/11 and Windows Server 2012 through 2025; a vendor patch is available and should be prioritized on internet- or partner-facing RADIUS infrastructure.
RemediationAI
Vendor-released patch: Microsoft has published fixed builds for every affected branch via the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83655), so apply the current cumulative security update and confirm the host reaches at least the listed build - 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2), 10.0.14393.9612 (Server 2016 / Win10 1607), 10.0.17763.9376 (Server 2019 / Win10 1809), 10.0.20348.5761 (Server 2022), 10.0.26100.33650 (Server 2025), 10.0.19044.7807 (Win10 21H2/22H2), 10.0.22631.7652 (Win11 23H2), 10.0.26100.9711 (Win11 24H2), 10.0.26200.9711 (Win11 25H2), 10.0.28000.3231 (Win11 26H1), and 10.0.26300.9711 (Win11 26H2). Where patching must be staged, the highest-value compensating control is to constrain who can reach the NPS listener: block inbound RADIUS ports (UDP/TCP 1812, 1813, and legacy 1645/1646) at the perimeter and from untrusted network segments, and restrict those ports by firewall rule to the known IP addresses of legitimate RADIUS clients, network access devices, and VPN concentrators - the trade-off is that any new or roaming client failing to match the allowlist will be unable to authenticate until the rule is updated. On hosts where the NPS role is installed but unused, removing the role eliminates the exposure entirely and costs nothing beyond decommissioning; disabling the IAS/NPS service and its listener achieves the same effect but must be coordinated with any dependent VPN, 802.1X, or NPS-proxied RADIUS flows, which will break immediately. Because the flaw is network-reachable and automatable, prioritize internet-facing, partner-facing, and multi-tenant RADIUS endpoints for immediate patching, and monitor the NPS event logs and Windows Error Reporting for repeated service crashes (faulting module in the NPS policy/RADIUS parsing path) as a likely indicator of attempted exploitation; note that there is no evidence of active exploitation at this time, so these measures are precautionary rather than incident-response driven.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Network Policy Server is Microsoft's implementation of the RADIUS server (and related NAP/NPS policy engine) shipped as an optional Windows Server role; clients and network access devices send authentication, authorization, and accounting requests to it over UDP 1812/1813 (or legacy 1645/1646) or RADIUS over TLS. The defect is a CWE-125 out-of-bounds read, meaning the parser for inbound network-supplied data reads past the end of an allocated buffer while processing a crafted request, leading to an access violation that terminates or destabilizes the NPS service process. Unlike an out-of-bounds write, this class does not directly enable memory corruption for code execution, which is consistent with the assessed CVSS impact of C:N/I:N/A:H - the practical result is a crash-based denial of service, with any memory-content leakage remaining theoretical and unproven here. Note that the accompanying intelligence tags list both 'Buffer Overflow' and 'Information Disclosure'; those tags overstate the assessed impact, since the authoritative vector assigns no confidentiality impact and the CWE maps to a read primitive rather than a write. The affected CPE scope is the Windows operating system images carrying the vulnerable NPS binaries, with EUVD enumerating specific build ranges across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 in both full and Server Core installations.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated network trigger with no interaction (AV:N/AC:L/PR:N/UI:N); out-of-bounds read yields service crash only, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.
Executive ViewAI
A remotely reachable flaw in Microsoft's Windows Network Policy Server (NPS) lets an unauthenticated attacker crash or degrade the service, disrupting the RADIUS-based authentication that governs VPN, Wi-Fi, and 802.1X access to corporate networks. The impact is availability-only - no data exposure or code execution - but because NPS is often a central chokepoint for network admission, an outage can lock legitimate users and devices out of production resources. A vendor patch is available, and the flaw affects a broad set of Windows client and server builds from Windows 10/11 through Windows Server 2012-2025, so leadership should treat internet- and partner-facing NPS infrastructure as the priority remediation target.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB