Windows Network Policy Server: Use-after-free leads to remote code execution

Summary

A use-after-free vulnerability in Network Policy Server (NPS) on Windows allows an unauthenticated attacker to execute code. The attack requires adjacent network access and a high-complexity condition, but no user interaction. The CVSS 3.1 base score is 7.5 (High).

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Versions 23H2, 24H2, 25H2 and 26H2, and 26H1 (see the MSRC page for exact builds)
• Windows Server 2012 and 2012 R2 (see the MSRC page for exact builds)
• Windows Server 2016 (10.0.14393.0 before 10.0.14393.9612)
• Note: one third-party source lists only Windows Server 2025 Server Core, which conflicts with the CNA data. Verify on MSRC.

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 (likely KB5126868, released 13 October 2026; not yet confirmed as the advisory's patch)
• Other products: build numbers at or above the fixed builds listed under affected, as stated in the CNA record
• Verify the exact fixed builds on the MSRC Security Update Guide

Workaround

Unknown. No vendor-published workaround was found.

• Practical measures (not from a vendor source): restrict which hosts can reach NPS/RADIUS ports, segment NPS servers from user and guest networks, and monitor for NPS service crashes or unexpected process activity.

Exploitation

• No evidence of exploitation in the wild was found.
• Not listed in CISA KEV (per OpenCVE).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept was found.
• EPSS: 0.00352.

Our recommendation

• Patch Windows Server 2016 NPS hosts with the October 2026 update now.
• Plan replacement of Windows 10 Version 1607 devices, since Microsoft has ended updates for LTSB 2016 on 13 October 2026.
• Check whether NPS is enabled on any host and whether it is reachable from user, guest or Wi-Fi networks; restrict access to RADIUS ports.
• Monitor NPS services for crashes and unusual process activity.
• Recheck CISA KEV and public exploit status in one to two weeks.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-85811 msrc.microsoft.com
• Microsoft Windows 10 1607 and Server 2016 release health learn.microsoft.com
• NVD mirror on Vulners: CVE-2026-85811 vulners.com
• MSRC feed mirror on Vulners: MS:CVE-2026-85811 vulners.com
• OpenCVE: CVE-2026-85811 app.opencve.io
• 4sysops: LTSB 2016 end of support and ESU 4sysops.com
• Wikipedia: Windows Server 2016 en.wikipedia.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:34.