CVE-2026-100222 is a remote-code-execution flaw in Microsoft Network Policy Server (NPS), the Windows service many organisations put behind enterprise Wi-Fi, wired 802.1X, VPN and remote-access authentication. It deserves attention not because every Windows machine is an NPS server, but because an NPS host often sits at a particularly consequential point: deciding who gets onto the network.
NPS is Microsoft’s RADIUS server and proxy. RADIUS centralises authentication, authorisation and accounting: a wireless controller, switch or VPN gateway asks it whether a user or device should be admitted. NPS can in turn check Active Directory Domain Services or local Windows accounts. That makes it common in Windows/Active Directory estates, while service providers and ISPs may run it to centralise customer wireless, VPN or remote-access authentication. Microsoft’s NPS overview describes those roles and deployment uses.
A crafted packet can reach the vulnerable service
The bug is a heap-based buffer overflow, also associated with integer underflow. Put simply, malformed network input can cause NPS to calculate or handle a buffer size incorrectly, then write beyond memory allocated for that data. An unauthenticated attacker can send a specially crafted packet to the affected service over the network; if exploitation succeeds, they can execute code on the target. No account and no user interaction are required.
That is why the network position matters. Exposure is about reachability to NPS, not whether an attacker already has a foothold in Active Directory. Teams should identify which RADIUS clients can send requests to each NPS instance, confirm that Internet-facing or partner-connected paths are intentional, and restrict access to only those clients where architecture permits. Those are sensible exposure reductions, not vendor workarounds: Microsoft lists neither a mitigation nor a workaround.
Microsoft rated the issue Important under its own maximum-severity system, while its CVSS 3.1 base score is 9.8, which is Critical under CVSS. The October 13, 2026 advisory assessment said exploitation was less likely, not publicly disclosed and not exploited; the October security-update coverage also records the patch release and restart requirement for affected products here.
Patch NPS hosts, then verify the build
Microsoft shipped fixes in its October 13 Windows security updates. Apply the appropriate update to every NPS system and plan the required restart. Fixed builds include 6.2.9200.26434 for Windows Server 2012, 6.3.9600.23470 for Server 2012 R2, 10.0.14393.9612 for Windows 10 1607/Server 2016, 10.0.17763.9376 for Windows 10 1809/Server 2019, 10.0.20348.5761 for Server 2022, and 10.0.26100.33650 for Server 2025; the affected-build record also lists supported Windows client releases and Server Core variants.
The client and Server Core entries need careful handling. NPS documentation describes it as a Windows Server role and says the role is unavailable on Server Core, but Microsoft still marks those products affected. The available material does not establish why; do not discard them from asset review simply on that basis. Confirm installed roles and build levels rather than inferring safety from an edition name.
No public exploitation signal yet
As of October 20, no credible exploitation-in-the-wild report or linked campaign had surfaced, and CVE-2026-100222 was not in CISA’s Known Exploited Vulnerabilities catalogue. No public proof of concept has surfaced either; indexed exploit repositories and scanners showed none, though that cannot rule out private code.
In practice, prioritise systems actually running NPS, patch and reboot them, then review which networks can send RADIUS traffic to them. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs, which helps keep authentication infrastructure from becoming the untracked exception.
