Vulnerabilities
CVE‑2026‑83655: NPS Denial‑of‑Service via Out‑of‑Bounds Read
A flaw in Windows Network Policy Server (NPS) allows an unauthenticated attacker to trigger an out‑of‑bounds read, causing a crash and denial of service. The issue affects all Windows Server 2022 and 2025 NPS deployments. Apply the latest cumulative update or patch to mitigate.
What happened
An unauthenticated attacker can send a specially crafted request to the Network Policy Server (NPS) service, causing an out‑of‑bounds read that triggers a crash. The crash results in a denial of service for all clients relying on NPS.
Impact
- All Windows Server 2022 and 2025 installations running NPS are vulnerable.
- Service interruption can affect authentication, authorization, and accounting for VPN, RADIUS, and other network services.
- Severity: CVSS 7.5 (High).
What to do
Apply the latest cumulative update that contains the NPS patch. If immediate patching is not possible, temporarily disable NPS or restrict inbound RADIUS traffic to trusted IP ranges.
Microsoft recommends deploying the update within 48 hours of release to minimize service disruption.
Related vulnerabilities
CVE-2026-108466: Windows Kernel Out-of-Bounds Read Causes Network Denial of Service
An out-of-bounds read in the Windows kernel (CVE-2026-108466) can be exploited by an unauthorized network attacker to trigger a denial of service. Microsoft has released a patch; administrators should update affected systems and monitor for abnormal traffic.
Read briefing
CVE-2026-83649: LSASS Out-of-Bounds Read Causes Network Denial of Service
A Windows LSASS vulnerability (CVE-2026-83649) permits an authorized user to trigger an out‑of‑bounds read that can crash the Local Security Authority Subsystem Service, leading to a denial of service over the network. The flaw affects all current Windows versions until a patch is applied. Defenders should verify patch status, monitor LSASS stability, and restrict privileged access.
Read briefing
CVE-2026-70063: Local Windows Kernel Information Disclosure Vulnerability
Microsoft has identified CVE-2026-70063, an out‑of‑bounds read in the Windows kernel that permits a local, authorized attacker to read sensitive memory. The flaw is fixed in the latest cumulative update for Windows 10, Windows 11, and Windows Server 2022. Defenders should verify that the update is installed and monitor for any anomalous local privilege activity.
Read briefing
Windows iSCSI Out-of-Bounds Read Enables Local Information Disclosure (CVE‑2026‑69721)
Microsoft disclosed an out-of-bounds read flaw in the Windows iSCSI Initiator service that lets local users with sufficient privileges read sensitive memory. The vulnerability affects all Windows systems running iSCSI and can expose credentials or keys. Defenders should patch immediately, disable iSCSI if unused, and limit local privileges.
Read briefing