CVE-2026-85799 in Windows
Summary
by MITRE • 10/14/2026
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves a critical use-after-free error within the Microsoft Network Policy Server, commonly known as NPS. This component is integral to Windows-based infrastructure for managing remote access policies and authentication protocols such as RADIUS. The flaw arises from improper memory management practices where the application continues to reference a block of memory after it has been freed or deallocated by the system. In complex network services like NPS, which handle high volumes of concurrent connection requests and policy evaluations, precise control over resource lifecycle is essential. When this discipline fails, the pointer retains its address but points to invalid or potentially attacker-controlled data, creating a dangerous state within the application's execution context.
From a technical perspective, use-after-free vulnerabilities are particularly severe because they allow an attacker to manipulate how the program interprets memory contents during subsequent operations. By carefully crafting network packets that trigger the premature deallocation of specific objects while ensuring those same pointers are accessed later in the processing pipeline, an unauthorized actor can overwrite adjacent memory structures or hijack control flow mechanisms such as function return addresses or virtual table pointers. This manipulation enables arbitrary code execution with the privileges of the NPS service account, which typically possesses significant administrative rights on the host system and within the domain environment. The attack vector is remote, meaning no physical access or prior authentication to the target machine is required beyond what is necessary to interact with the RADIUS service itself.
The operational impact of this vulnerability extends far beyond a single compromised server. Because NPS often serves as the central authority for network access policies across an enterprise, compromising it can lead to widespread disruption and security breaches. An attacker gaining code execution on the NPS host could potentially extract sensitive credentials stored in memory or configuration files, modify authentication rules to allow unauthorized users into the internal network, or pivot further into the domain by exploiting trust relationships between servers. This effectively undermines the integrity of the entire identity management infrastructure, allowing for lateral movement and persistent access that is difficult to detect without specialized monitoring tools focused on anomalous RADIUS traffic patterns.
Industry standards classify this type of flaw under CWE-416, Use After Free, which highlights the failure to properly manage memory allocation and deallocation cycles. In terms of offensive security frameworks like MITRE ATT&CK, this vulnerability facilitates initial access through remote service exploitation (T1210) and potentially privilege escalation if the NPS process runs with elevated permissions. Mitigation strategies must prioritize immediate patching using official vendor updates that address the memory management logic within the Network Policy Server component. Until patches are applied, organizations should consider restricting network-level access to RADIUS ports by implementing strict firewall rules or placing the service behind a Web Application Firewall capable of inspecting and filtering malformed packets. Additionally, deploying intrusion detection systems tuned for anomalies in authentication traffic can help identify exploitation attempts before they result in successful code execution.