CVE-2026-85371 in Windows
Summary
by MITRE • 10/14/2026
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves a use-after-free condition within the Microsoft Network Policy Server, commonly known as NPS. This component is responsible for authenticating and authorizing users who connect to a network via protocols such as Remote Authentication Dial-In User Service (RADIUS) or Extensible Authentication Protocol (EAP). A use-after-free error occurs when software continues to reference memory that has already been deallocated by the system's garbage collector or manual memory management routines. In this specific context, an attacker can exploit this flaw by sending specially crafted network packets to the NPS service. When the server processes these malformed requests, it may attempt to access memory locations that have previously been freed but not yet reallocated for other purposes. This discrepancy allows the attacker to inject malicious code or manipulate execution flow within the privileged context of the Network Policy Server process.
The operational impact of this vulnerability is severe due to its potential for remote code execution without requiring user interaction or authentication in certain configurations, although typically it requires valid credentials depending on the specific implementation details and network segmentation. If successfully exploited, an attacker gains the ability to execute arbitrary code on the affected system with the same privileges as the NPS service account. This often translates to SYSTEM-level access if the service runs under local system accounts, which is common in Windows Server environments. Such access enables the adversary to install programs, view, change, or delete data, and create new administrator accounts. Furthermore, because NPS handles authentication for network resources, compromising it can facilitate lateral movement across an enterprise network by allowing the attacker to forge valid authentication tokens or bypass security controls that rely on accurate identity verification.
From a classification perspective, this vulnerability aligns with CWE-416, which defines Use After Free as a type of memory corruption error where a pointer is used after its associated memory has been freed. This category of flaws often leads to unpredictable behavior, including crashes and arbitrary code execution. In terms of the MITRE ATT&CK framework, exploitation of this vulnerability falls under techniques related to Initial Access and Privilege Escalation. Specifically, it relates to exploiting services that are accessible over a network (T1072) and potentially leveraging compromised credentials or tokens for persistence and lateral movement if the attacker maintains access after initial code execution. The attack vector is classified as Network-based, indicating that no physical access or local user interaction is required beyond sending packets across the network interface where NPS listens for authentication requests.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is to apply the latest security patches provided by Microsoft for the affected Windows Server versions running Network Policy Server. Organizations should prioritize patching servers exposed to untrusted networks or those handling sensitive authentication traffic. Additionally, network segmentation plays a critical role in limiting exposure; NPS services should be restricted to communicate only with authorized access points and VPN concentrators using firewall rules that limit source IP addresses to known trusted ranges. Implementing strict input validation on any custom integrations with the RADIUS protocol can also reduce risk. Security teams should monitor for anomalous authentication patterns or unusual memory usage spikes in NPS processes, which may indicate an attempted exploitation of this vulnerability. Regular audits of service accounts and their permissions ensure that even if a compromise occurs, the blast radius is contained by adhering to the principle of least privilege.