Vulnerabilities
CVE-2026-85806: Remote Code Execution in Windows Network Policy Server
Microsoft identified a critical remote code execution flaw in Network Policy Server (NPS) that could allow attackers to run arbitrary code on unpatched Windows Server systems. Systems with NPS enabled are vulnerable. Defenders should apply the latest patch, disable NPS if unused, and monitor for suspicious activity.
What happened
Microsoft disclosed CVE-2026-85806, a remote code execution vulnerability in the Network Policy Server (NPS) component of Windows Server. The flaw allows an unauthenticated attacker to send a specially crafted request to the NPS service and execute arbitrary code with SYSTEM privileges.
Impact
Any Windows Server installation that has NPS enabled and is not patched is at risk. Attackers could gain full control of the host, pivot to other systems, or exfiltrate data. The vulnerability is rated CVSS 9.8 (Critical).
What to do
- Verify if NPS is installed and enabled on your servers.
- Apply the latest cumulative update for Windows Server that contains the NPS fix.
- If NPS is not required, disable or uninstall the feature.
- Implement network segmentation to limit exposure of the NPS port.
- Enable logging for NPS and monitor for anomalous connection attempts.
Mitigation
Microsoft recommends installing the cumulative update as soon as possible. Until the patch is applied, consider blocking inbound traffic to the NPS port from untrusted networks using firewall rules or Azure Network Security Groups.
Microsoft has acknowledged the vulnerability and released a patch. No additional exploit code is publicly available.
Related vulnerabilities
CVE-2026-70014: Windows Cryptographic Services Remote Code Execution Exploit
Microsoft has identified a critical remote code execution flaw (CVE-2026-70014) in Windows Cryptographic Services that can be triggered by an authenticated attacker over the network. The use‑after‑free bug allows arbitrary code execution with service privileges on Windows 10, 11 and Server 2016‑2022. Apply the latest security update and restrict network access to mitigate the risk.
Read briefing
CVE‑2026‑62819: Remote Code Execution in Windows RRAS Service
Microsoft has identified a remote code execution flaw in the Routing and Remote Access Service (RRAS) that could allow attackers to execute arbitrary code on affected Windows Server systems. The vulnerability is present in Windows Server 2012 R2 through 2022 and requires immediate patching or service disablement.
Read briefing
CVE‑2026‑83655: NPS Denial‑of‑Service via Out‑of‑Bounds Read
A flaw in Windows Network Policy Server (NPS) allows an unauthenticated attacker to trigger an out‑of‑bounds read, causing a crash and denial of service. The issue affects all Windows Server 2022 and 2025 NPS deployments. Apply the latest cumulative update or patch to mitigate.
Read briefing
Microsoft Remote Desktop Client RCE via Use‑After‑Free (CVE‑2026‑108458)
A use‑after‑free flaw in Windows Remote Desktop Client allows an unauthenticated network attacker to execute arbitrary code. The vulnerability affects all versions of the client that ship with Windows 10/11 and Windows Server 2019/2022. Apply the latest Microsoft security update and enforce RDP restrictions immediately.
Read briefing