CVE-2026-96246
7.5HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-125
Impact
Unauthenticated remote attackers can read sensitive memory contents over the network from an exposed Network Policy Server. They only need network reachability to the NPS service without any credentials or user interaction.
Root cause
An out-of-bounds read flaw (CWE-125) in Network Policy Server handles network requests without properly validating buffer boundaries.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Install the relevant Windows security update from the vendor advisory once identified; if patching must wait, restrict network and firewall access to the NPS ports (UDP 1812/1813 and 1645/1646) strictly to trusted RADIUS clients.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.