PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-85806 Microsoft CVE debrief

A critical vulnerability exists in the Network Policy Server (NPS) of various Windows versions, allowing for remote code execution. This issue arises from an integer underflow (wrap or wraparound) in NPS. Multiple Windows versions and server editions are affected, including Windows 10, Windows 11, and Windows Server versions. The vulnerability allows an unauthorized attacker to execute code over a network. Defenders should assess exposure and prioritize patching. The CVE Program and NVD provide official records of this vulnerability. Microsoft has released a patch for this issue.

Vendor
Microsoft
Product
Windows 10 Version 1607
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-13
Original CVE updated
2026-10-13
Advisory published
2026-10-13
Advisory updated
2026-10-13

Who should care

Defenders responsible for Windows systems, particularly those using Network Policy Server, should assess exposure and prioritize patching. They should review NPS configurations and monitor network traffic for potential exploitation attempts. Defenders should also verify affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-85806 is a critical vulnerability in Network Policy Server (NPS) that allows remote code execution. Multiple Windows versions are affected. Defenders should prioritize patching and review NPS configurations.

  • Remote code execution without authentication.
  • Potential for lateral movement within networks.
  • Need for immediate patching to prevent exploitation.
  • Possible impact on network security and integrity.

Technical summary

The Network Policy Server (NPS) vulnerability allows an unauthorized attacker to execute code over a network due to an integer underflow (wrap or wraparound). The vulnerability affects multiple Windows versions and server editions, including Windows 10, Windows 11, and Windows Server versions. Defenders should prioritize patching immediately, as this vulnerability allows for remote code execution without authentication.

Defensive priority

Defenders should prioritize patching immediately, as this vulnerability allows for remote code execution without authentication.

Recommended defensive actions

  • Apply patches from Microsoft for affected Windows versions.
  • Review and update Network Policy Server configurations.
  • Monitor network traffic for potential exploitation attempts.

Evidence notes

The CVE Program and NVD provide official records of this vulnerability. Microsoft has released a patch for this issue. The vulnerability affects multiple Windows versions and server editions, including Windows 10, Windows 11, and Windows Server versions. Defenders should verify affected scope, severity, and vendor guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-85806 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-85806

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-85806 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85806

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.