Windows Server NDES EUVD-2026-99463

Exploitation requires the target to have the Active Directory Certificate Services Network Device Enrollment Service (NDES) role installed and reachable - this is an optional PKI role (typically used for SCEP-based certificate enrollment of network/mobile devices), not a default Windows Server feature, so hosts without NDES are not affected. The attacker must already hold low-level authenticated network access (CVSS PR:L), and the high attack complexity (AC:H) means success depends on a specific condition outside the attacker's control (e.g., a particular enrollment interaction, timing, or configuration state) rather than a single deterministic request. No user interaction is required (UI:N). These factors - role must be present, authentication required, and non-trivial complexity - substantially limit realistic exploitation despite the network attack vector.

This is a moderate-risk, enterprise-contextual vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, base 6.8) describes a network-reachable but authenticated (PR:L) flaw with high attack complexity (AC:H), meaning exploitation requires some privileges plus conditions outside the attacker's control. Every signal points away from mass exploitation: there is no CISA KEV listing and no public exploit identified at time of analysis, and CISA's SSVC framework explicitly rates Exploitation as 'none' and Automatable as 'no' - so the exploitation status is 'no public exploit identified at time of analysis.' The one amplifying signal is SSVC Technical Impact rated 'total,' which aligns with the C:H/I:H impact: a successful spoofing attack against NDES could meaningfully undermine certificate-based trust. Note a metadata inconsistency to verify: the input Tag labels this 'Information Disclosure,' but both the description and CWE-1390 (Weak Authentication) characterize it as a spoofing/authentication-bypass issue, and the CVSS shows C:H AND I:H (not a pure confidentiality loss) - treat the 'Information Disclosure' tag as unreliable. Overall this is a 'patch in normal cycle' item for most, but a priority for organizations running NDES as part of their PKI, because the total technical impact lands on a trust-anchor service.

An attacker with low-level authenticated network access to an environment running the Network Device Enrollment Service abuses weak authentication in the enrollment flow to spoof the identity of a legitimate enrollment party, obtaining or impersonating credentials/certificates they should not be entitled to. Because attack complexity is high, the attacker must win a specific condition (such as timing, configuration state, or a particular enrollment interaction) rather than firing a single reliable request. No public exploit code is identified at time of analysis, so this currently requires a skilled, motivated actor.