Network Policy Server: Heap-based buffer overflow allows remote code execution

Summary

Microsoft Network Policy Server (NPS), the RADIUS and policy server often used for Wi-Fi 802.1X, VPN and network access, contains a heap-based buffer overflow. An authenticated attacker with low privileges on the network may execute code on the server. Attack complexity is high, and the attacker needs valid access to the NPS service. Microsoft rates the issue Important and reports no public disclosure or exploitation.

Affected

• Windows 10 Version 1607: builds below 10.0.14393.9612
• Windows 10 Version 1809: builds below 10.0.17763.9376
• Windows 10 Version 21H2: builds below 10.0.19044.7807
• Windows 10 Version 22H2: builds below 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2: builds below 10.0.26100.9711
• Windows 11 Version 25H2: builds below 10.0.26200.9711
• Windows 11 Version 26H1: builds below 10.0.28000.3231
• Windows 11 Version 26H2: builds below 10.0.26300.9711
• Windows Server 2012 and Server Core: builds below 6.2.9200.26434
• Windows Server 2012 R2 and Server Core: builds below 6.3.9600.23470
• Windows Server 2016: builds below 10.0.14393.9612

Fixed in

• Install the Microsoft security update of 13 October 2026 for your Windows version.
• Fixed builds: 10.0.14393.9612 (1607 and Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2).
• Required KB number: Unknown. Check the MSRC page for your build.

Workaround

• No vendor workaround known.
• If the NPS role is not required, remove or disable it (recommended by OpenCVE, a secondary source).
• Restrict access to the NPS/RADIUS ports to known clients such as access switches, Wi-Fi controllers and VPN gateways (own recommendation, not a vendor statement).

Exploitation

• Microsoft: not publicly disclosed, not exploited, exploitability 'Exploitation Less Likely'.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• VulDB: no technical details or public exploit available.
• Not listed in CISA KEV (per OpenCVE).

Our recommendation

• Identify all hosts running the Network Policy Server role, especially on Windows 10 1607 or Server 2016.
• Patch affected NPS servers in the next maintenance window, regardless of version.
• Limit NPS exposure to the internal network and known RADIUS clients; never expose NPS to the internet.
• Check whether Windows 10 1607 is still supported and whether ESU applies, using Microsoft's lifecycle pages.
• Monitor NPS and authentication logs for unusual activity and recheck the MSRC page and CISA KEV regularly.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• CVE record mirror (Vulners, CNA data) vulners.com
• NVD record mirror (Vulners) vulners.com
• VulDB entry vuldb.com
• OpenCVE entry app.opencve.io
• Strix summary www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:57.