CVE-2026-50496: Windows NPS SNMP Information Disclosure

CVE-2026-50496 Overview

CVE-2026-50496 is an out-of-bounds read vulnerability [CWE-125] in the Windows Network Policy Server (NPS) SNMP component. An unauthenticated remote attacker can send crafted SNMP traffic to a vulnerable NPS instance and trigger a read beyond an allocated buffer boundary. Microsoft categorizes the primary impact as availability loss, meaning successful exploitation can crash the service and disrupt authentication, authorization, and accounting (AAA) flows that rely on NPS. The vulnerability requires no privileges and no user interaction, and it is reachable over the network. Microsoft published details in the security update guide entry for Microsoft Security Update CVE-2026-50496.

Critical Impact
Unauthenticated network attackers can trigger a denial of service against Windows Network Policy Server, disrupting RADIUS-based authentication for VPN, wireless, and 802.1X clients.

Affected Products

Microsoft Windows Server with the Network Policy Server (NPS) role installed
Windows Server deployments exposing SNMP-connected NPS services
Environments using NPS as a RADIUS server for VPN, wireless, or 802.1X access control

Discovery Timeline

2026-07-14 - CVE-2026-50496 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-50496

Vulnerability Analysis

The flaw resides in the SNMP handling code path of the Windows Network Policy Server role. When NPS parses an incoming SNMP message, it reads data from a buffer without correctly validating the boundary between the requested read length and the actual size of the allocated memory region. This mismatch causes the process to access memory outside the intended buffer, producing an out-of-bounds read condition classified under [CWE-125].

The CVSS vector indicates no impact on confidentiality or integrity, but a high impact on availability. In practice, the out-of-bounds read causes the service process to terminate rather than leaking meaningful memory contents to the attacker. NPS acts as the Microsoft implementation of a RADIUS server, so a crash removes authentication for downstream VPN concentrators, wireless controllers, and switches performing 802.1X.

Root Cause

The root cause is insufficient bounds checking during SNMP message parsing. The parser trusts a length or offset value derived from attacker-supplied input and uses it to index into a fixed-size buffer. When the value exceeds the buffer capacity, the read crosses into unmapped or unrelated memory and triggers an access violation.

Attack Vector

Exploitation requires network reachability to the SNMP interface on a host running the NPS role. An attacker sends a malformed SNMP packet designed to exercise the vulnerable parsing path. No credentials, prior foothold, or user interaction are required. Because SNMP typically runs over UDP port 161, the packet can be delivered from any host that can route traffic to the target. Repeated triggering can produce a sustained denial of service against RADIUS-dependent services.

No public proof-of-concept exploit is currently listed for CVE-2026-50496, and it is not present on the CISA Known Exploited Vulnerabilities catalog. The EPSS model estimates a 1.149% probability of exploitation activity in the next 30 days.

Detection Methods for CVE-2026-50496

Indicators of Compromise

Unexpected termination or repeated restarts of the IAS (Internet Authentication Service) process hosting NPS on Windows Server
Windows Event Log entries showing service crashes correlated with inbound SNMP traffic on UDP port 161
RADIUS authentication failures reported by VPN concentrators, wireless controllers, or 802.1X switches that point to an NPS backend

Detection Strategies

Inspect SNMP traffic destined for NPS hosts for malformed or oversized PDUs that deviate from RFC-compliant structure
Correlate NPS service crash events with source IP addresses of recent SNMP requests to identify probing activity
Alert on any inbound SNMP traffic to servers holding the NPS role, since this combination is atypical in most environments

Monitoring Recommendations

Forward Windows System and Application event logs from NPS servers to a centralized logging platform for crash pattern analysis
Monitor network flow data for spikes in UDP port 161 traffic toward Windows Server hosts running the NPS role
Track RADIUS availability metrics from dependent access devices to detect service disruption early

How to Mitigate CVE-2026-50496

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-50496 advisory to all affected Windows Server systems running the NPS role
Restrict inbound SNMP (UDP 161) traffic to NPS hosts using host-based firewall rules and network access control lists
Inventory all servers with the NPS role installed and confirm patch status against Microsoft's guidance

Patch Information

Microsoft addressed CVE-2026-50496 through its monthly security update process. Refer to the Microsoft Security Update CVE-2026-50496 entry for the specific KB numbers, affected Windows Server builds, and installation prerequisites. Apply the update through Windows Update, WSUS, or your endpoint management tooling and validate that the NPS service returns to a healthy state after reboot.

Workarounds

Disable the SNMP service on NPS hosts where it is not operationally required
Segment NPS servers into a management network that is unreachable from user or guest subnets
Implement RADIUS server redundancy so that a single NPS crash does not interrupt authentication for dependent services

bash

# Configuration example: block inbound SNMP to an NPS host using Windows Firewall
New-NetFirewallRule -DisplayName "Block Inbound SNMP to NPS" `
  -Direction Inbound `
  -Protocol UDP `
  -LocalPort 161 `
  -Action Block `
  -Profile Any