EUVD-2026-99785
GHSA-prp5-ffhj-c6px
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach NDES endpoint over network
-
DeliverySend malformed enrollment request
-
ExploitTrigger out-of-bounds read in NDES
-
ExecutionCrash or hang service
-
ImpactDeny certificate enrollment
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Windows Server has the Network Device Enrollment Service (NDES) role of Active Directory Certificate Services installed and its SCEP/HTTP(S) endpoint reachable by the attacker - NDES is not present in a default Windows Server installation, which is the primary factor limiting real-world exposure. Where NDES is deployed and network-reachable, the CVSS vector indicates no authentication, privileges, or user interaction are needed (PR:N/UI:N/AC:L). Patched builds per EUVD are: Windows 10/Server 2019 ≥10.0.17763.9376, Server 2016/Win10 1607 ≥10.0.14393.9612, Server 2022 ≥10.0.20348.5761, Server 2025 ≥10.0.26100.33650, Server 2012 ≥6.2.9200.26434, and Server 2012 R2 ≥6.3.9600.23470; the resulting impact is limited to availability (service disruption) with no confidentiality or integrity loss. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw whose sole impact is availability (C:N/I:N/A:H) - i.e. a denial-of-service, consistent with the description 'deny service over a network' and CWE-125 (out-of-bounds read). No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 7.5 is driven entirely by the easy-reach-but-DoS-only profile rather than by code execution or data theft. This is a patch-on-schedule item, not an emergency: the impact ceiling is service disruption of one role, not compromise. Two input signals conflict with the authoritative CVSS and should be treated with caution - the 'Information Disclosure' tag contradicts C:N (the vector asserts no confidentiality impact), and the 'Buffer Overflow' tag overstates a read-only out-of-bounds condition; verify against the Microsoft advisory before treating this as anything beyond a DoS. A critical scoping caveat: NDES is an optional Active Directory Certificate Services role not installed by default, so the AV:N 'unauthenticated network' exposure only materializes on servers where NDES is actually deployed and reachable. |
| Exploit ScenarioDerived | An attacker with network reachability to a Windows Server running the NDES (SCEP) endpoint sends a crafted request that triggers an out-of-bounds read in the service, causing it to crash or become unresponsive. Because no authentication or user interaction is required (PR:N/UI:N), any client that can reach the NDES HTTP(S) endpoint can repeatedly disrupt certificate enrollment. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Out-of-bounds memory reads in Microsoft's Network Device Enrollment Service (NDES) allow a remote, unauthenticated attacker to disrupt certificate-enrollment service by sending crafted requests to a reachable SCEP endpoint, yielding a denial-of-service condition rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exposure is narrow in practice: NDES is an optional Active Directory Certificate Services role that is not present in a default Windows Server installation, so only hosts where the role has been deployed and its HTTP/HTTPS SCEP interface is network-reachable are at risk, and the vector requires no authentication, privileges, or user interaction. Impact is confined to availability - the assessed vector shows no confidentiality or integrity loss - and no public exploit identified at time of analysis, though vendor patches are available for all affected builds.
RemediationAI
Primary remediation is to apply the Microsoft vendor updates noted as available; use the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96861 to map your platform to its servicing update, and confirm the resulting build meets or exceeds the fixed thresholds: 10.0.17763.9376 for Windows 10 1809 and Server 2019, 10.0.14393.9612 for Windows 10 1607 and Server 2016, 10.0.20348.5761 for Server 2022, 10.0.26100.33650 for Server 2025, 6.2.9200.26434 for Server 2012, and 6.3.9600.23470 for Server 2012 R2. Because the flaw is unauthenticated and network-reachable, patch latency should be minimized on any host exposing SCEP. If immediate patching is not possible, the most effective compensating control is to restrict network access to the NDES SCEP endpoint - typically the IIS-hosted /certsrv/mscep/ (mscep.dll) path over HTTP/HTTPS - with host or perimeter firewall rules that allow only known enrollment clients and management subnets; the trade-off is that any legitimate device or client outside those ranges will be unable to enroll or renew certificates. If the NDES role is not actively used, remove it entirely, which eliminates exposure at the cost of losing SCEP-based enrollment. Additional hardening includes enforcing HTTPS with client-certificate or IP allow-listing at the IIS site, and fronting the endpoint with a reverse proxy or WAF that rejects malformed or oversized enrollment payloads; these measures reduce reachability but do not correct the underlying parsing defect, so they must be treated as temporary. Monitor IIS/System event logs for repeated w3wp worker-process crashes correlated with SCEP requests as an indicator of exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NDES is Microsoft's implementation of the Simple Certificate Enrollment Protocol (SCEP), delivered as a role of Active Directory Certificate Services and hosted through IIS, where the enrollment handler (mscep.dll) parses attacker-supplied enrollment payloads over HTTP/HTTPS. The flaw is classified as CWE-125 (Out-of-bounds Read), a memory-safety defect in which the handler consumes an attacker-controlled length or structure without adequately validating it against the size of the underlying buffer, causing reads past the end of allocated memory. Practically, this manifests as a crash or fault of the IIS worker process servicing SCEP requests rather than as a memory-corruption primitive, which is consistent with the assessed vector's C:N/I:N/A:H profile. Note the supplied tags ('Buffer Overflow', 'Information Disclosure') versus the authoritative assessment: an out-of-bounds read is memory-safety class, and the assessed CVSS vector assigns no confidentiality impact, so the operationally meaningful outcome here is service disruption, not data leakage. The CWE-125 class also implies the parsing path deals with variable-length ASN.1/PKCS structures (PKCS#10 requests, PKCS#7 signed data, GetCACert responses), which is where input-size validation typically fails. Because the CVSS vector contains PR:N/UI:N/AC:L with AV:N, any host that can route to the NDES endpoint can attempt the request without credentials or user interaction.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable NDES endpoint, no auth or interaction (AV:N/AC:L/PR:N/UI:N); out-of-bounds read yields service crash only, so C:N/I:N/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
Executive ViewAI
CVE-2026-96861 is a high-severity, unauthenticated remote denial-of-service flaw in Microsoft's Network Device Enrollment Service (NDES) that can disrupt certificate enrollment on any server where that optional Active Directory Certificate Services role has been deployed and its SCEP interface is network-reachable. Because NDES is not present in a default Windows Server installation, exposure is confined to a limited set of hosts that support device onboarding and certificate lifecycle workflows, but an outage there can stall new device and user certificate issuance. Leadership should care primarily about service availability for PKI-dependent onboarding rather than data compromise, and should weigh a targeted inventory-and-patch effort against the narrow footprint. There is no public exploit identified at time of analysis, and no confidentiality or integrity impact is assessed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB