Network Policy Server EUVD-2026-99869

Exploitation requires the attacker to reach and be authorized against the Network Policy Server (NPS) role - the Windows RADIUS/802.1X authentication service - which must be installed and running (NPS is not enabled by default on a base OS and is typically present only on servers acting as RADIUS or NAP infrastructure). The CVSS vector (PR:L) indicates some level of authorized access is required, so this is an authenticated attack, not anonymous remote. AC:H means reliable exploitation of the heap overflow is non-trivial and likely requires heap grooming, which limits opportunistic use. Limiting factors: the target must have the NPS role deployed, the attacker needs prior authorized network access, and no user interaction is involved (UI:N) but success is probabilistic given the high complexity.

This is a genuine but not top-tier priority. The CVSS 7.5 (HIGH) reflects total C/I/A impact (C:H/I:H/A:H) and a network vector (AV:N), but several signals pull the real-world risk down. Attack complexity is HIGH (AC:H) and privileges are required (PR:L), meaning the attacker must already be an authenticated/authorized party and must win a non-trivial heap-grooming race to exploit the overflow reliably. CISA's SSVC framework reinforces this: Exploitation=none (no observed activity), Automatable=no (cannot be reliably scripted at scale), though Technical Impact=total (full code execution if successful). There is no CISA KEV listing and no EPSS score provided, so exploitation probability cannot be quantified from the input. No POC is referenced. The signals are internally consistent - a high-impact, high-complexity, privilege-requiring flaw that is NOT currently being exploited and is NOT readily automatable - so treat this as 'patch on normal cadence, prioritize on internet-exposed or multi-tenant RADIUS/NPS servers' rather than an emergency. Note that EPSS and KEV data are absent from the input, so the exploitation-probability picture is inferred from SSVC alone and should be re-checked against live feeds.

An attacker who already holds low-level authorized access on the network (e.g., a valid user able to reach the NPS/RADIUS service) sends crafted authentication or policy traffic that corrupts the NPS process heap, culminating in arbitrary code execution on the Windows Server hosting the Network Policy Server role. Because attack complexity is HIGH and exploitation is not automatable, success requires precise heap manipulation rather than a simple one-shot packet. No public exploit code was identified at time of analysis.