EUVD-2026-99756
GHSA-4w9x-c3qx-xcvg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach NPS RADIUS listener over network
-
DeliverySend crafted authentication packet
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionLeak adjacent process memory
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target Windows host to have the Network Policy Server (NPS) role installed and running as a RADIUS/NAP server with its network listener reachable by the attacker; NPS is not enabled by default, so only systems actively configured as RADIUS/NAC servers are exploitable. No authentication, privileges, or user interaction are required (PR:N/UI:N), and exploitation works against default NPS configurations once the role is deployed. The principal limiting factor is exposure of the NPS service - isolating RADIUS endpoints to trusted network segments sharply reduces realistic attack surface; impact is confined to information disclosure with no integrity or availability effect. |
| Impact | Multiple signals align to a moderate-but-real priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated information-disclosure flaw with high confidentiality impact only (C:H/I:N/A:N), yielding a 7.5 base score - the 'high' rating is driven entirely by confidentiality, not integrity or availability. The SSVC framework tempers this: Exploitation is 'none' (no observed or public exploitation), Technical Impact is only 'partial', but Automatable is 'yes', meaning if an exploit emerged it could be scripted against many targets. There is no CISA KEV listing and no public exploit identified, so active-exploitation risk is currently low. The key limiting factor not captured in the raw score is scope of exposure: NPS is an optional Windows Server role, so only hosts actually running NPS as a RADIUS/NAC server are affected, not every patched Windows system in the affected-versions list. Net: patch on a normal prioritized cadence, prioritizing internet- or segment-exposed NPS/RADIUS servers; this is a credible network info-leak, not a wormable RCE. |
| Exploit ScenarioDerived | An attacker with network access to a Windows Server running the Network Policy Server (RADIUS) role sends a crafted RADIUS/authentication request that triggers an out-of-bounds read in NPS packet parsing, causing the service to return or leak adjacent process memory. This could disclose sensitive data such as configuration details, memory fragments, or credential material useful for follow-on attacks. No public exploit code has been identified at time of analysis, and exploitation requires reaching the NPS listener over the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An unauthenticated, remote out-of-bounds read in Microsoft Windows Network Policy Server (NPS) can leak the contents of process memory to any attacker able to reach the NPS network listener, with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflecting high confidentiality impact and no integrity or availability effect. Affected systems are Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 installations that have the NPS role deployed and running as a RADIUS/NAC server; NPS is not enabled by default, so the realistic attack surface is limited to hosts whose RADIUS endpoints are reachable across network segments. CISA's SSVC assessment rates the issue as automatable with partial technical impact and no observed exploitation, and no public exploit code has been identified at time of analysis, making this a moderate-but-real priority rather than an emergency rather than a confirmed active threat.
RemediationAI
Vendor-released patches are available: Microsoft has published fixes through the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96246, so the primary action is to apply the current cumulative update for each affected branch, which raises systems to at least the fixed builds Windows 10 1607 10.0.14393.9612, Windows 10 1809 and Server 2019 10.0.17763.9376, Windows 10 21H2/22H2 10.0.19044.7807, Windows 11 23H2 10.0.22631.7652, Windows 11 24H2 10.0.26100.9711, Windows 11 25H2 10.0.26200.9711, Windows 11 26H1 10.0.28000.3231, Windows 11 26H2 10.0.26300.9711, Windows Server 2016 10.0.14393.9612, Windows Server 2022 10.0.20348.5761, Windows Server 2025 10.0.26100.33650, Windows Server 2012 6.2.9200.26434, and Windows Server 2012 R2 6.3.9600.23470. Because exploitation requires an attacker to reach the NPS listener, the most effective compensating control where patching must be staged is to confine RADIUS traffic to trusted network segments - apply host firewall rules restricting UDP 1812/1813 (and legacy 1645/1646) plus any configured RADIUS client management ports to known NAS, VPN concentrator and 802.1X authenticator addresses, accepting that this breaks legitimate authentication from any client outside that allow-list. If the NPS role is installed but no longer used, remove the role entirely to eliminate the listener; if it is needed, review and prune NPS remote RADIUS server groups, connection request policies and unused RADIUS clients, since each adds a reachable parser entry point, and consider terminating RADIUS at a hardened, segmented proxy instead of exposing Windows NPS directly. Note that the SSVC signals describe the flaw as automatable, so firewall scoping should be treated as a temporary measure rather than a substitute for the vendor patch; no public exploit code or confirmed active exploitation was identified at time of analysis, so there is no evidence of broad scanning pressure to prioritize against other emergencies.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-125 (Out-of-bounds Read) in the packet-handling path of the Windows Network Policy Server, the built-in Microsoft implementation of RADIUS that also provides Network Access Protection (NAP) and 802.1X policy evaluation for VPN, Wi-Fi and wired authentication. Because NPS performs authentication, authorization and accounting by parsing attacker-supplied RADIUS messages arriving over the network, a memory-safety defect in that parser allows a crafted request to read past the end of an allocated buffer and return or otherwise expose adjacent heap memory - classically credential material, policy data or pointer values useful for further attacks. The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is reachable over the network without credentials or user interaction and works against default NPS configurations once the role is deployed, which is consistent with the reported 'unauthorized attacker' wording; the principal precondition is simply that the NPS listener be exposed and reachable. The related build-level data covers Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations, indicating a shared code base across the supported Windows servicing branches rather than a single product line.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable RADIUS listener with no auth or interaction (AV:N/AC:L/PR:N/UI:N); out-of-bounds read leaks memory so C:H but I:N/A:N and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.
Executive ViewAI
A remotely reachable memory-disclosure flaw in Microsoft's Network Policy Server (NPS) means any system running the NPS/RADIUS role could expose sensitive process memory - potentially including authentication material - to an attacker anywhere on the network without needing credentials. Because NPS is the component that validates who gets onto the network, exposure here risks weakening the trust decisions the business relies on for Wi-Fi, VPN, and 802.1X access; however, only hosts with the NPS role deployed and reachable have that exposure, and no exploitation has been observed. Leadership should treat this as a scheduled, high-priority patching item rather than a crisis, while confirming exactly which servers and endpoints in the estate run the role.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB