CVE-2026-85811: Network Policy Server Use After Free Flaw

CVE-2026-85811 Overview

CVE-2026-85811 is a use-after-free vulnerability [CWE-416] in Microsoft Network Policy Server (NPS). The flaw allows an unauthorized attacker to execute code over an adjacent network. Exploitation does not require authentication or user interaction. NPS implements RADIUS authentication, authorization, and accounting for network access requests. A successful attacker can compromise confidentiality, integrity, and availability on the targeted server. Microsoft published the advisory on October 13, 2026.

Critical Impact
An unauthenticated attacker with adjacent network access can trigger a use-after-free condition in NPS and execute arbitrary code in the context of the service.

Affected Products

Microsoft Windows Server with Network Policy Server (NPS) role enabled
Refer to the Microsoft CVE-2026-85811 Advisory for the full product and build matrix
RADIUS infrastructure dependent on affected NPS deployments

Discovery Timeline

2026-10-13 - CVE CVE-2026-85811 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85811

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] inside the Network Policy Server. NPS processes RADIUS protocol messages that arrive on UDP ports 1812 and 1813 by default. During message handling, the service releases a memory object while retaining a dangling reference that can be reused in subsequent operations. An attacker who controls the content and timing of these messages can place attacker-controlled data in the freed region. The reused reference then dereferences adversary-shaped memory, enabling arbitrary code execution in the NPS process context. The attack requires adjacent network access, meaning the attacker must reach the NPS service from the same broadcast or logical network segment.

Root Cause

The root cause is improper lifetime management of a heap object during RADIUS request processing. NPS frees the object before all code paths finish using it, violating object ownership assumptions. No authentication is required to reach the vulnerable code path, which widens the exposure for exposed NPS instances.

Attack Vector

Exploitation proceeds over an adjacent network with no credentials and no user interaction. The attacker crafts a sequence of RADIUS packets to trigger the free, then reclaim the memory region with controlled contents before the dangling reference is used. The high attack complexity reflects the race or heap-grooming conditions required to achieve reliable code execution. Successful exploitation yields code execution as the NPS service account, which typically holds elevated privileges on the server. See the Microsoft CVE-2026-85811 Advisory for authoritative technical details.

Detection Methods for CVE-2026-85811

Indicators of Compromise

Unexpected crashes, access violations, or restarts of the IAS service hosting NPS on Windows Server
Anomalous RADIUS traffic patterns on UDP 1812 and 1813, including malformed attributes or oversized packets
Child processes spawned by svchost.exe hosting NPS, especially command interpreters such as cmd.exe or powershell.exe
Outbound network connections initiated from the NPS service process to untrusted hosts

Detection Strategies

Monitor Windows Event Log sources IAS and Microsoft-Windows-NPS for parser errors and abnormal termination events
Alert on Windows Error Reporting entries that reference the NPS service binary
Inspect network sensors for RADIUS packets originating from unexpected VLANs or subnets that should not communicate with NPS

Monitoring Recommendations

Baseline normal RADIUS client IP addresses and alert on new or spoofed sources
Enable process creation auditing (Event ID 4688) on NPS hosts and review child processes of the NPS service
Forward NPS logs and endpoint telemetry to a centralized analytics platform for correlation with network flow data

How to Mitigate CVE-2026-85811

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-85811 Advisory as soon as testing permits
Inventory all servers with the Network Policy Server role enabled and prioritize internet-exposed or multi-tenant segments
Restrict RADIUS traffic to known client IP addresses using host firewall and network ACLs
Review NPS service account privileges and reduce rights where feasible

Patch Information

Microsoft has issued a security update addressed in the Microsoft CVE-2026-85811 Advisory. Administrators should consult the advisory for build numbers, KB identifiers, and supported Windows Server versions, then deploy the update through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

Segment NPS servers onto isolated management VLANs that are not reachable from general user networks
Enforce IPsec or firewall rules that limit UDP 1812 and 1813 to authorized RADIUS clients only
Where NPS is not required, disable the role using Uninstall-WindowsFeature NPAS until patching is complete
Monitor for service crashes and investigate restarts as potential exploitation attempts

bash

# Configuration example
# Restrict NPS RADIUS traffic to approved clients using Windows Firewall
New-NetFirewallRule -DisplayName "Allow RADIUS Auth from Approved Clients" -Direction Inbound -Protocol UDP -LocalPort 1812 -RemoteAddress 10.10.20.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Allow RADIUS Acct from Approved Clients" -Direction Inbound -Protocol UDP -LocalPort 1813 -RemoteAddress 10.10.20.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block RADIUS from Untrusted" -Direction Inbound -Protocol UDP -LocalPort 1812,1813 -Action Block