Advisory · CVE-2026-100222
Heap overflow in Windows Network Policy Server allows unauthenticated code execution
Windows Network Policy Server (NPS) has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
- Vendor
- Microsoft
- Product
- Windows Network Policy Server
- Identifier / CWE
- CVE-2026-100222
CWE-122 - Action timing
- Immediate
Explain it like I’m five
The RADIUS gatekeeper writes past the end of its scratch space when fed a crafted request, and the overflow becomes the attacker's code.
- 01Reach the component
An unauthenticated attacker sends crafted network traffic to a Windows system running Windows Network Policy Server.
- 02Memory flaw triggers
The component mishandles the input and corrupts or reuses memory outside its intended bounds.
- 03Code runs
The attacker gains code execution in the component's context on the target system.
What happened
Microsoft disclosed CVE-2026-100222 in its October 2026 update guide: a heap-based buffer overflow (CWE-122) in Network Policy Server lets an unauthorized attacker execute code over a network across a wide range of Windows and Windows Server releases.
Microsoft lists the affected Windows releases in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Windows Network Policy Server deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Windows Network Policy Server while remediation is underway, especially for internet-facing instances.
- Review application and server logs for NPS service crashes, malformed RADIUS requests in logs, and authentication anomalies around the time of failures.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
NPS decides who gets on the network. Code execution there is both a host compromise and an access-control problem, so patch and review authentication logs together.