Key points
- Microsoft Network Policy Server contains a critical remote code execution flaw tracked as CVE-2026-85806.
- The vulnerability stems from an integer underflow that allows unauthorized attackers to execute code over a network.
- The National Vulnerability Database rates the issue with a CVSS score of 9.8, marking it as critical severity.
Microsoft has identified a critical security vulnerability in its Network Policy Server component that enables remote code execution by unauthorized attackers. According to the Microsoft Security Update Guide, the flaw is tracked as CVE-2026-85806 and involves an integer underflow condition within the service processing logic.
The National Vulnerability Database records this issue with a CVSS score of 9.8, classifying it as critical. The weakness allows an attacker to execute arbitrary code over a network, leveraging the integer wraparound error to compromise the system hosting the Network Policy Server.
Technical Context
The underlying technical issue involves an integer underflow, also known as a wrap or wraparound error. The NVD record associates this vulnerability with CWE-121 and CWE-191, indicating memory corruption risks stemming from improper arithmetic handling. This type of error typically occurs when a value decreases below the minimum limit for its data type, causing it to wrap around to a large positive value.
Affected Environments
Any organization deploying Microsoft Network Policy Server is potentially exposed to this remote code execution risk. The advisory does not specify particular versions, implying that the flaw may exist across multiple releases of the software. Security teams must assume that any instance of NPS is vulnerable until confirmed otherwise.
Next steps
Security operations teams should immediately inventory all systems running Network Policy Server. Organizations must focus on containment and monitoring while reviewing network access controls to limit exposure of NPS services to untrusted networks. Teams should await further guidance from the vendor regarding remediation steps.
Signals worth monitoring
Teams usually detect this type of exploitation by looking for unusual process creation events originating from the NPS service account. Check whether the server is generating unexpected outbound network connections or executing scripts from temporary directories. Monitor for rapid memory allocation spikes that could indicate buffer manipulation. First containment moves involve isolating the affected host from the network and preserving volatile memory for forensic analysis.
What to do and how to stay safe: Microsoft
- Audit firewall rules to restrict access to Network Policy Server ports from untrusted network segments.
- Enable detailed logging on NPS servers to capture all authentication attempts and service interactions.
- Monitor system integrity monitoring alerts for unexpected changes to NPS binary files or configuration settings.
- Prepare incident response playbooks for remote code execution scenarios until the vendor provides an update.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for the Microsoft NPS vulnerability?
The vulnerability is tracked as CVE-2026-85806.
How severe is the Microsoft NPS integer underflow flaw?
The National Vulnerability Database rates it as critical with a CVSS score of 9.8.
Is there a patch available for CVE-2026-85806?
The source material is an advisory from the Microsoft Security Update Guide, but does not explicitly confirm a released fix.
