{"id":"CVE-2026-85806","published":"2026-10-13T19:21:04.770","lastModified":"2026-10-16T19:41:41.870","description":"Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-121","CWE-191"],"vendors":["microsoft"],"products":["windows 10 1607","windows 10 1809","windows 10 21h2","windows 10 22h2","windows 11 23h2","windows 11 24h2","windows 11 25h2","windows 11 26h1","windows 11 26h2","windows server 2012","windows server 2016","windows server 2019"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85806","tags":["Vendor Advisory","Patch"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical integer underflow vulnerability in Microsoft's Network Policy Server allows remote attackers to execute arbitrary code with system-level privileges. This flaw occurs when processing network policy requests, potentially enabling attackers to gain full control over affected systems.","exploitability":"Exploitation appears moderately difficult as it likely requires crafting specific network policy requests that trigger the integer underflow condition, but could be automated given sufficient network access to the NPS endpoint.","blast_radius":"If exploited, this vulnerability could allow attackers to compromise entire network infrastructure by executing code on the NPS server, potentially affecting all network access control and authentication services.","remediation":"Apply Microsoft Security Update KB5042738 or upgrade to Windows Server 2022 version 22H2 or later with the latest cumulative updates installed.","detection":"Monitor for unusual network policy request patterns in Windows Event Log 4624 (successful logon events) and 4625 (failed logon events) that show unexpected authentication failures or successful authentications from unusual sources, particularly when combined with high CPU usage on NPS services.","tags":["rce","network","authentication","windows"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:50:19.195Z"}}