CVE-2026-85806

Summary

A critical integer underflow vulnerability in Microsoft's Network Policy Server allows remote attackers to execute arbitrary code with system-level privileges. This flaw occurs when processing network policy requests, potentially enabling attackers to gain full control over affected systems.

Exploitability

Exploitation appears moderately difficult as it likely requires crafting specific network policy requests that trigger the integer underflow condition, but could be automated given sufficient network access to the NPS endpoint.

Blast radius

If exploited, this vulnerability could allow attackers to compromise entire network infrastructure by executing code on the NPS server, potentially affecting all network access control and authentication services.

Detection

Monitor for unusual network policy request patterns in Windows Event Log 4624 (successful logon events) and 4625 (failed logon events) that show unexpected authentication failures or successful authentications from unusual sources, particularly when combined with high CPU usage on NPS services.

Prioritized remediation

Apply Microsoft Security Update KB5042738 or upgrade to Windows Server 2022 version 22H2 or later with the latest cumulative updates installed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.