Windows NPS: Denial of service via out-of-bounds read

Summary

An out-of-bounds read in the Windows Network Policy Server (NPS) allows an unauthenticated attacker on the network to cause a denial of service. The vendor rates the impact as availability only, with no confidentiality or integrity impact. A successful attack can block RADIUS-based authentication for Wi-Fi, VPN or network access.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (builds before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (builds before 6.3.9600.23470)
• Windows Server 2016 (builds before 10.0.14393.9612)

Fixed in

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9612 (KB5126868 per Microsoft release health, pending confirmation on MSRC)
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470

Fixed builds are taken from the CNA data; verify them on the MSRC advisory.

Workaround

Unknown. No vendor-published workaround was found. For systems that cannot be patched, restrict access to the NPS RADIUS ports (UDP 1812 and 1813 by default) to known switches, access points and VPN gateways.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: Exploitation none, Automatable yes, technical impact partial.
• No public proof of concept found; this is absence of evidence only.
• EPSS about 0.01, i.e. low predicted exploitation probability.

Our recommendation

• Inventory all systems with the NPS role and their Windows versions.
• Install the security update for each affected version as soon as possible, starting with Windows Server 2016 and 2012 systems running NPS.
• Limit access to NPS RADIUS ports to known devices and make sure NPS is not reachable from the internet or guest networks.
• Windows 10 Enterprise LTSB 2016 reached end of updates on 13 October 2026. Plan migration to a supported release or evaluate Extended Security Updates with Microsoft or the reseller.
• Monitor NPS service availability and logs for crashes or repeated malformed requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center advisory CVE-2026-83655 msrc.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 learn.microsoft.com
• Vulners CVE record (CVE List) vulners.com
• OpenCVE CVE-2026-83655 app.opencve.io
• Vulners NVD record (EPSS) vulners.com
• 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com
• Wikipedia: Windows Server 2016 en.wikipedia.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:51.