CVE-2026-85323: NDES Authentication Bypass Vulnerability

CVE-2026-85323 Overview

CVE-2026-85323 is a weak authentication vulnerability in Microsoft's Network Device Enrollment Service (NDES). The flaw allows an authorized attacker to perform spoofing over a network against the certificate enrollment infrastructure. NDES acts as an intermediary between network devices and a certification authority, issuing certificates to devices that cannot authenticate using domain credentials. The weakness is categorized under [CWE-1390] (Weak Authentication) and affects the confidentiality and integrity of certificates issued through the service. Microsoft published the advisory on October 13, 2026.

Critical Impact
An authenticated attacker can spoof identities over the network to obtain or influence certificates issued by NDES, undermining trust in device enrollment.

Affected Products

Microsoft Network Device Enrollment Service (NDES)
Windows Server deployments running the NDES role
Active Directory Certificate Services environments configured with NDES

Discovery Timeline

2026-10-13 - CVE-2026-85323 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85323

Vulnerability Analysis

NDES provides a Simple Certificate Enrollment Protocol (SCEP) interface so network devices and other non-domain-joined endpoints can request certificates from an Active Directory Certificate Services (AD CS) certification authority. CVE-2026-85323 stems from a weakness in how NDES authenticates requesters during the enrollment flow.

An attacker with existing authorized access to the environment can abuse the weak authentication path to assume the identity of another principal. Successful exploitation permits a spoofed enrollment request to be accepted by NDES, leading to issuance or manipulation of certificates that misrepresent the requester. The attack is executed over the network and does not require user interaction, though the attack complexity is high.

Root Cause

The underlying issue is classified as [CWE-1390] Weak Authentication. The NDES component fails to sufficiently validate the identity of the caller during certificate enrollment transactions. This gap enables an authenticated adversary to supply crafted request parameters that are accepted as if they originated from a different, trusted principal.

Attack Vector

The vulnerability is exploitable over the network. The attacker must already hold low-privilege authorization within the environment and must successfully complete additional conditions reflected in the high attack complexity. Once exploited, the adversary can impersonate another user or device within the enrollment workflow and obtain certificates that enable further lateral movement or impersonation inside the public key infrastructure.

No public proof-of-concept code is available for CVE-2026-85323. Refer to the Microsoft CVE-2026-85323 Update Guide for technical details and patch references.

Detection Methods for CVE-2026-85323

Indicators of Compromise

Unexpected certificate issuance events in AD CS logs where the subject or Subject Alternative Name does not match the authenticated requester.
SCEP enrollment requests to the NDES endpoint originating from unusual source addresses or service accounts.
Newly issued certificates with elevated privileges or Enhanced Key Usage values that deviate from the standard device enrollment template.

Detection Strategies

Correlate NDES IIS logs with AD CS issuance events to identify requests where the authenticated caller differs from the certificate subject.
Alert on bursts of SCEP challenge or enrollment requests from a single authenticated principal that exceed baseline device enrollment volumes.
Monitor for authentication to the /certsrv/mscep and /certsrv/mscep_admin virtual directories from non-administrative accounts.

Monitoring Recommendations

Forward NDES, IIS, and AD CS event logs to a centralized analytics platform for cross-source correlation.
Track issuance of certificates based on templates used by NDES and flag anomalies in requester identity, timing, or source network.
Review Kerberos and NTLM authentication events against the NDES host for signs of credential replay or relay activity.

How to Mitigate CVE-2026-85323

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-85323 Update Guide to all servers running the NDES role.
Audit recently issued certificates from NDES-connected templates and revoke any that cannot be tied to a legitimate enrollment.
Restrict network access to the NDES endpoints so only authorized device management infrastructure can reach the service.

Patch Information

Microsoft has released a security update for CVE-2026-85323. Review the Microsoft CVE-2026-85323 Update Guide for the specific KB articles, affected Windows Server builds, and installation guidance. Apply the update through Windows Update, WSUS, or your enterprise patch management workflow.

Workarounds

Place NDES behind an authenticating reverse proxy such as Microsoft Entra application proxy to constrain which clients can submit SCEP requests.
Enforce certificate template permissions so that only the dedicated NDES service account can enroll on behalf of devices, and restrict Subject Alternative Name options on those templates.
Rotate the NDES service account credentials and the SCEP challenge password following patch deployment.

bash

# Configuration example
# List certificate templates issued by the enterprise CA for review
certutil -CATemplates

# Review NDES-related IIS application settings
%windir%\system32\inetsrv\appcmd.exe list app /site.name:"Default Web Site"