CVE-2026-50470

What it actually does

This vulnerability is an unauthenticated network-reachable out-of-bounds read in the Windows Network Policy Server SNMP handling path. A crafted SNMP request can cause the affected service to read memory outside the intended buffer and return sensitive process or service memory contents to the requester. The impact is confidentiality-only: the flaw does not directly allow code execution, privilege escalation, or data modification, but it may disclose information useful for follow-on attacks, such as memory contents, configuration fragments, service state, or other sensitive runtime data exposed through the vulnerable parsing path.

Why it matters to the business

Organizations running affected Windows client or server versions with Network Policy Server SNMP exposure may unintentionally leak sensitive information to anyone who can reach the SNMP service over the network. This can weaken perimeter and internal security by helping attackers enumerate infrastructure, recover sensitive operational details, or improve the reliability of later attacks. Because exploitation is network-based, unauthenticated, low-complexity, and requires no user interaction, internet-exposed or broadly reachable SNMP services should be treated as high priority even though the issue is not currently listed in CISA KEV and no public exploit maturity is reported.

How an attack unfolds

An attacker first identifies a Windows system running an affected version with SNMP reachable, typically over UDP/161. The attacker sends specially crafted SNMP traffic to the Network Policy Server SNMP component. Due to improper bounds checking, the component reads past the expected memory boundary and returns data that should not be exposed. The attacker captures and analyzes the response for sensitive values, memory fragments, service configuration details, or other information that may support credential attacks, network mapping, bypass development, or chaining with other vulnerabilities. The attack does not require authentication, local access, or user interaction, so exposure depends primarily on whether the vulnerable SNMP path is enabled and reachable from attacker-controlled networks.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so use the applicable Microsoft cumulative update or security-only update for the affected operating system release. Where immediate patching is not possible, restrict SNMP access to trusted management networks only, block inbound SNMP from untrusted networks at firewalls and host firewalls, disable SNMP where it is not required, and avoid exposing Network Policy Server management interfaces to the internet. Review SNMP community strings and SNMPv3 authentication settings, but do not rely on them as the primary mitigation because the vulnerability is described as unauthorized and network-exploitable.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the relevant Microsoft security update released for this vulnerability or a later cumulative update. Validate that SNMP exposure is reduced by scanning from untrusted network segments and confirming UDP/161 and any related SNMP management paths are not reachable except from approved monitoring systems. On hosts where SNMP is not required, confirm the SNMP service and related Network Policy Server SNMP functionality are disabled. For systems that must run SNMP, perform authenticated configuration review to ensure access control lists, Windows Defender Firewall rules, and network firewall rules limit SNMP to trusted management sources. Vulnerability scanners should no longer report the affected Windows/NPS SNMP condition after patching and service restart, if required by the update.

Typical attack path

1. Scan for Windows systems exposing SNMP, commonly on UDP/161.
2. Identify hosts likely running affected Windows client or server versions with Network Policy Server or SNMP components enabled.
3. Send crafted unauthenticated SNMP requests designed to trigger the out-of-bounds read condition.
4. Collect SNMP responses and inspect returned data for unintended memory disclosure.
5. Use the disclosed information to improve reconnaissance, identify sensitive configuration, or support subsequent attacks against the same environment.

How to detect it

Look for evidence of suspicious SNMP activity against Windows systems running Network Policy Server or SNMP services, especially from untrusted, external, or unusual internal sources. Useful data sources include firewall logs, NetFlow, IDS/IPS telemetry, packet captures, Windows Firewall logs, EDR network connection telemetry, Windows System logs for SNMP service activity, and NPS operational logs if enabled. Focus on UDP/161 traffic to affected Windows hosts, spikes in SNMP requests, requests from non-monitoring systems, repeated malformed or unusual SNMP payloads, and responses with abnormal sizes. Because information disclosure vulnerabilities may not create reliable host artifacts, network telemetry is usually the strongest detection source. If packet capture is available, review SNMP request/response exchanges for malformed BER/ASN.1 encoding, unexpected object identifiers, repeated probing, or unusually large responses. Also investigate any follow-on activity from the same source IPs, such as credential probing, service enumeration, SMB/RDP scanning, or attempts to access management services.

• UDP/161
• UDP/162
• SNMP
• SNMP Service
• SNMPTRAP
• snmp.exe
• snmptrap.exe
• NPS
• Network Policy Server
• Microsoft-Windows-NPS
• Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
• DROP UDP 161
• ALLOW UDP 161
• BER decode error
• malformed SNMP
• public
• private

What your security team should do

• Prioritize patching internet-exposed and broadly reachable Windows servers running SNMP or Network Policy Server components.
• Inventory all affected Windows 10, Windows 11, and Windows Server systems and identify where SNMP is enabled or reachable.
• Block UDP/161 and UDP/162 from untrusted networks unless explicitly required for approved monitoring paths.
• Disable SNMP on systems where it is not operationally necessary.
• Restrict SNMP access to dedicated monitoring hosts or management subnets using host firewalls and network ACLs.
• Review network telemetry for unusual SNMP probes or malformed SNMP request patterns targeting Windows systems since the publication date.
• After patching, rescan externally and internally to confirm SNMP is not exposed beyond intended management boundaries.
• Monitor vendor advisories for updated fixed build information, exploit availability, or changes in exploitation status.