CVE-2022-41097
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
An information disclosure vulnerability in the RADIUS protocol in Network Policy Server (NPS) allows an attacker to gain access to sensitive data. The flaw could be exploited to intercept authentication information or other data transmitted over the network.
Risk Assessment
The risk involves potential disclosure of confidential information, which could lead to network security breaches and theft of authentication data.
Recommendation
It is recommended to apply Windows security updates and monitor RADIUS traffic for suspicious activities.
Other vulnerabilities in Network Policy Server (NPS)
See all- CVE-2026-96246High
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.
- CVE-2026-85799High
A use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
- CVE-2026-85371High
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
- CVE-2026-70207High
Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Network Policy Server (NPS) RADIUS Protocol Information Disclosure Vulnerability
Vulnerability data from NVD (NIST) · CISA KEV · EPSS