IT SBIT Services
Schneeberger
DEEN
CVE tracker

Network Policy Server (NPS): Remote code execution via integer underflow

CVE-2026-85806Critical 9.8

← All vulnerabilities

Summary

Microsoft Network Policy Server (NPS) contains an integer underflow (CWE-191, CWE-121) that allows an unauthorized network attacker to execute code. The CVSS score is 9.8 (critical) and no user interaction or privileges are required. Exposure of NPS to untrusted networks determines how urgent the risk is for your organisation.

Affected

  • Windows 10 Version 1607 and Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)
  • Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
  • Windows 10 Version 21H2 and 22H2 (10.0.19044.0 to before 10.0.19044.7807; 10.0.19045.0 to before 10.0.19045.7807)
  • Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (see the CNA record for exact ranges)
  • Windows Server 2012 and 2012 R2, including Server Core (6.2.9200.0 to before 6.2.9200.26434; 6.3.9600.0 to before 6.3.9600.23470)
  • The CPE in the NVD record lists only Windows 10 1607, which is incomplete.

Fixed in

  • Install the October 2026 security update for each affected system. The CNA record gives the first fixed build per branch (for example 10.0.14393.9612 for 1607 and Server 2016, 6.2.9200.26434 for Server 2012, 6.3.9600.23470 for Server 2012 R2).
  • Verify the fixed build for each system in the Microsoft Security Update Guide before relying on it.

Workaround

Unknown. No vendor workaround is listed in the sources.

Exploitation

  • CISA SSVC data: exploitation none, automatable yes, technical impact total.
  • Microsoft rates exploit maturity as unproven (E:U).
  • No public proof of concept was found. The entry was not found in the CISA KEV catalogue at the time of research; this is provisional.

Our recommendation

  • Patch in the first wave for any NPS server reachable from untrusted or guest networks or from the internet.
  • Patch all other affected NPS systems in the normal critical update cycle.
  • Verify which systems run the NPS role and which Windows versions they use.
  • Limit which hosts can reach the NPS RADIUS ports and keep NPS off untrusted segments. Never expose NPS to the internet.
  • Monitor NPS logs for unusual traffic until patching is complete.
  • Patch the other Network Policy Server CVEs from the October 2026 update in the same cycle.
  • Reassess the priority if exploitation is reported.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Remote code execution – Network Policy Server (NPS)
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5127648, KB5126651, KB5126655, KB5126657, KB5126646, KB5126653

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:27.

Original description (NVD)

Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed