CVE-2026-85323

MediumCVSS 6.8

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

41th percentile - higher than 41% of all known CVEs

Summary

A weak authentication vulnerability in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network. The issue involves an insufficient authentication mechanism.

Risk Assessment

An authorized remote attacker may impersonate a trusted entity in the PKI infrastructure. This can lead to issuance of unauthorized certificates.

Recommendation

Apply Microsoft security updates for NDES. Strengthen authentication mechanisms and restrict network access to the service.

Other vulnerabilities in Network Device Enrollment Service (NDES)

CVE-2022-37959Medium
A Security Feature Bypass Vulnerability in the Network Device Enrollment Service (NDES). The description does not include technical details of the vulnerability mechanism.

Original NVD description (English source)

Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS