Network Policy Server (NPS): Use-after-free allows remote code execution

Summary

Microsoft's Network Policy Server (NPS) contains a use-after-free vulnerability (CWE-416). An unauthenticated attacker on the network can exploit it to execute code on the affected system. Attack complexity is high, and the CVSS 3.1 base score is 8.1.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 and Server Core (6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)
• Note: the affected product list in the CVE record is broader than the single CPE entry (Windows 10 1607). Verify on MSRC which versions apply to your systems.

Fixed in

• Fixed builds per the affected ranges above, e.g. Windows 10 1607 and Server 2016: 10.0.14393.9612 or later.
• The KB number for Windows 10 1607 is unknown in this assessment. Take the KB numbers from the MSRC Security Update Guide.
• Known KB references (not verified for every version): KB5126646 (Server 2025), KB5126651 (Windows 10 1809 / Server 2019).

Workaround

• Restrict network access to the NPS service, for example to known RADIUS clients only (UDP 1812/1813).
• Disable the NPS role on systems where it is not needed.
• Monitor for unusual NPS or RADIUS traffic.
• No official Microsoft workaround was confirmed in this assessment.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS is about 0.67%.
• No public proof-of-concept or exploitation reports were found, but search coverage was limited.

Our recommendation

• Inventory all hosts with the NPS role and their Windows versions.
• Check whether NPS is reachable from the internet or untrusted network segments. If so, treat this as urgent.
• Confirm the fixed build and KB for each version on the MSRC page and patch in the next update cycle; for internal-only NPS, the regular Patch Tuesday cycle is acceptable.
• Restrict RADIUS traffic and disable NPS where it is not needed.
• Check the Microsoft lifecycle page for Windows 10 1607. Isolate or replace unsupported systems, because they cannot be patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85371 msrc.microsoft.com
• NVD mirror on Vulners: CVE-2026-85371 vulners.com
• Microsoft CVE entry on Vulners: MS:CVE-2026-85371 vulners.com
• OpenCVE: CVE-2026-85371 app.opencve.io
• Strix: CVE-2026-85371 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:23.