Microsoft NPS Remote Code Execution Flaw Rated Critical

An integer underflow in Network Policy Server allows remote code execution, according to new Microsoft and NVD records.

Threat Times Exposure DeskOctober 14, 20262 min read

Illustration: A network policy server sits in a dark room, its chassis glowing with harsh red warning lights. — AI-generated illustration: Threat Times

Key points

CVE-2026-85806 affects Microsoft Network Policy Server and allows remote code execution by unauthorized attackers.
The vulnerability is rated 9.8 Critical by the National Vulnerability Database due to its high severity score.
The flaw stems from an integer underflow weakness, classified under CWE-121 and CWE-191 standards.

Microsoft has documented a critical remote code execution vulnerability in its Network Policy Server component, identified as CVE-2026-85806. According to the official Microsoft Security Update Guide, this flaw allows an unauthorized attacker to execute arbitrary code over a network.

The National Vulnerability Database assigns this vulnerability a CVSS score of 9.8, classifying it as Critical. This severity rating is based on the CVSS metrics provided in the NVD record. The weakness involves a wrap or wraparound error in how the server processes specific integer values.

Technical Details and Classification

The underlying technical cause is an integer underflow, which occurs when a calculation results in a value smaller than the minimum limit for the data type. According to the NVD record, this specific issue maps to Common Weakness Enumerations CWE-121 and CWE-191. These categories cover buffer errors and integer underflow issues that can lead to memory corruption or unexpected program behavior.

Microsoft’s advisory summary states that the integer underflow in Network Policy Server allows an unauthorized attacker to execute code over a network. This remote exploitability means that attackers can initiate the attack vector from a distance. The flaw is identified within the Network Policy Server component.

Affected Systems and Scope

The vulnerability specifically impacts Microsoft Network Policy Server, a component often used in enterprise environments for network access control and policy enforcement. According to the source material, the affected product is explicitly named as Network Policy Server. No specific version numbers or operating system editions are listed in the provided advisory text.

Organizations relying on NPS for RADIUS authentication or network access protection are potentially exposed to this risk. The lack of specified version constraints in the current advisory suggests that the issue may affect multiple deployments. Security teams must verify which servers in their infrastructure are running the vulnerable component.

What should you do?

Security professionals should immediately inventory their environments to identify any servers running Microsoft Network Policy Server. Since the flaw allows remote code execution, isolating affected systems from untrusted networks can reduce the attack surface while a permanent solution is sought. Monitoring network logs for unusual traffic patterns directed at NPS ports may help detect exploitation attempts.

What to do and how to stay safe: Microsoft

Audit your network infrastructure to locate all instances of Microsoft Network Policy Server and determine their exposure to external networks.
Review firewall rules to restrict access to NPS services, ensuring only trusted authentication clients can communicate with the server.
Monitor system logs and network traffic for anomalous activity that could indicate an attempt to exploit the integer underflow vulnerability.
Prepare to apply security updates once the vendor provides an official patch or mitigation guidance for CVE-2026-85806.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.