External risk intelligence

NPS Integer Underflow Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-85806

Network Policy Server (NPS) acts as a RADIUS server, which is commonly deployed at the edge of networks to manage authentication, authorization, and accounting for remote access, VPNs, and wireless infrastructure. Given its role in managing external connectivity and authentication traffic, it is frequently exposed or reachable in deployments that facilitate remote access.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Network Policy Server, a component used for managing network access and authentication. This issue could allow unauthorized attackers to execute code remotely, potentially impacting network security and the integrity of user access controls. The primary concern is to confirm if our environment utilizes this technology and assess potential exposure.

Network access control software has a critical flaw.
Critical flaw allows remote code execution over network.
Confirm relevance and potential exposure of this technology.

Attack Path

How an attacker could exploit the issue

An attacker could reach the Network Policy Server (NPS) over the network due to its common deployment at network perimeters. By sending specially crafted network traffic, the attacker could trigger an integer underflow vulnerability within NPS. This vulnerability, if successfully triggered, could allow an unauthorized attacker to execute code remotely.

Unauthenticated network access required.
Specially crafted network traffic triggers vulnerability.
Remote code execution possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Network Policy Server (NPS) could allow an attacker to execute code over a network when supported by the advisory.

Network access and code execution.
Remote network code execution is possible.
Compromised server and network access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Network Policy Server (NPS) is typically managed by infrastructure or platform teams, with ultimate accountability residing with the application owner or a dedicated vendor management team if NPS is part of a vendor-supplied solution. The first practical step is to identify all NPS deployments, determine their network exposure and business criticality, and confirm the responsible owner. Subsequent remediation planning should be risk-based, potentially involving coordination with security and network teams.

Own by infrastructure and application teams.
Verify network exposure and criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Network Policy Server (NPS)?

Network Policy Server is a component used to manage network access, authentication, and authorization. It functions as a RADIUS server, serving as a centralized point for verifying user credentials and defining connection policies for remote access, VPNs, and wireless networking infrastructure.

What does integer underflow mean for CVE-2026-85806?

This vulnerability involves an integer underflow, a type of calculation error categorized as CWE-191. In this context, it occurs when the software performs arithmetic that results in a value smaller than the minimum allowable limit. This flaw disrupts memory processing, which can be manipulated to allow unauthorized code execution.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted network traffic to the affected server. The issue requires no prior authentication to initiate. It is not triggered by standard, legitimate network traffic, but specifically by packets designed to exploit the integer underflow condition during processing.

Is my server at risk if it runs NPS?

According to Halo Surface Signal, risk is elevated because NPS is often deployed at network perimeters to manage external connections like VPNs. If your NPS instance is internet-facing or reachable from untrusted network segments, it is more likely to be exposed to the crafted traffic required to trigger this vulnerability.

What should I do if I use this software?

Your first step is to locate all instances of Network Policy Server within your environment. Once identified, evaluate their specific network exposure and business criticality. Collaborate with your infrastructure or platform teams to confirm ownership and track official security updates for this technology.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85806

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.