External risk intelligence

NPS Heap-Based Buffer Overflow Allows Network Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-100222

Network Policy Server (NPS) is commonly used to handle authentication, authorization, and accounting for network access. As a service that frequently manages remote access and connectivity gateways, it is often positioned at the network edge or in a role that accepts traffic from various network segments, making public or perimeter-facing exposure a common deployment pattern.

Buffer Overflow

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Microsoft's Network Policy Server (NPS) software. This flaw could allow an unauthorized attacker to execute arbitrary code remotely, potentially impacting network access controls and sensitive data. The main concern at this stage is confirming if our environment utilizes this specific technology and faces a potential exposure.

Remote code execution risk in Network Policy Server.
Affects network access and potential data compromise.
Confirm relevance and exposure to manage risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to the Network Policy Server. Because the vulnerability is network-accessible with no authentication required, an attacker could trigger a heap-based buffer overflow. This could allow the attacker to execute arbitrary code on the affected system, potentially leading to a complete compromise.

Entry Condition: No authentication required.
Trigger Point: Sending network requests to NPS.
Resulting Risk: Remote code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

Heap-based buffer overflow in Network Policy Server (NPS) could enable an unauthorized remote attacker to execute arbitrary code. This may affect system integrity and availability when the NPS service is exposed to a network.

System integrity and availability.
Remote code execution over network.
Service disruption or compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Network Policy Server (NPS) plays a critical role in network access control, and its potential exposure makes this vulnerability a priority. Identifying all NPS deployments, assessing their network reachability and business criticality, and confirming the accountable owner are the essential first steps. This foundational understanding will enable effective risk assessment and the planning of targeted remediation efforts, whether through direct patching, configuration changes, or other compensating controls.

Network/Security or Infrastructure teams own.
Verify NPS external reachability and critical assets.
Plan risk-based remediation with affected owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Network Policy Server (NPS)?

NPS is a server role in Windows Server environments used to centralize network authentication, authorization, and accounting. It manages access requests for VPNs, wireless connections, and switch-based network entry points, acting as a critical gateway that verifies user credentials and enforces connection policies before granting network access.

What does a heap-based buffer overflow mean for CVE-2026-100222?

This vulnerability, classified as CWE-122, happens when the software tries to store more data in a specific area of memory (the heap) than it is designed to hold. In the context of CVE-2026-100222, this memory corruption allows an attacker to overwrite adjacent data, potentially hijacking the system's execution flow to run unauthorized code.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted network packets to the NPS service. Because the vulnerability does not require authentication, an attacker can initiate the exploit remotely without needing valid credentials or prior access to the network. Simply sending benign, standard traffic will not trigger the memory corruption.

Do I need to worry about external exposure?

Yes, if your NPS instances are reachable from untrusted networks. According to Halo Surface Signal, because NPS frequently manages remote connectivity, it is often positioned at the network edge or in segments that accept traffic from various origins. This common deployment pattern makes it highly relevant to audit if your server faces the public internet.

What are the first steps to address this CVE?

Begin by auditing your infrastructure to locate all active NPS deployments. Coordinate with your network and security teams to determine which servers are reachable from outside your protected environment and assess their business importance. Once you have a clear inventory of these high-priority systems, you can prioritize remediation through patching or configuration adjustments.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100222

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.