Microsoft PPP EAP-TLS Flaw Lets Attackers Run Code Without Credentials

Microsoft has confirmed a critical security flaw in its Point-to-Point Protocol implementation that allows attackers to run arbitrary code on affected systems. The vulnerability, tracked as CVE-2026-84015, affects the EAP-TLS component used for secure remote access connections. According to the Microsoft Security Update Guide, the issue stems from a heap-based buffer overflow that an unauthorised attacker can exploit over a network.

The National Vulnerability Database rates the severity of CVE-2026-84015 at 9.8, placing it in the highest critical category. This high score reflects the ease with which an attacker can trigger the flaw without needing valid credentials. The weakness, categorised under CWE-122, enables remote code execution, meaning an adversary could potentially take full control of a targeted device or server from a distance.

What we know

The Microsoft advisory describes the technical root cause as a heap-based buffer overflow within the Remote Access Point-to-Point Protocol. Specifically, the flaw resides in the EAP-TLS extension, which is designed to provide mutual authentication and encryption for PPP connections. The National Vulnerability Database confirms that this buffer overflow allows an unauthorised attacker to execute code over a network, bypassing standard access controls.

Microsoft’s update guide states that the vulnerability enables remote code execution without requiring prior authentication. This means an attacker does not need to guess passwords or steal tokens to initiate the exploit. The affected component processes network traffic in a way that allows malicious data to overwrite memory boundaries, leading to the execution of attacker-controlled instructions.

Defender's checklist

• Verify if any internal servers or network devices rely on legacy PPP EAP-TLS configurations for remote access.
• Review firewall rules to ensure that unnecessary PPP traffic is blocked at the network perimeter.
• Check system logs for unusual memory allocation errors or unexpected process executions that may indicate exploitation.
• Audit remote access policies to confirm that modern, patched protocols are enforced instead of older standards.

The background in plain language

Organisations often use older connection protocols to maintain compatibility with legacy hardware or specific network infrastructure. When these systems process data, they allocate temporary memory spaces called heaps. If a protocol does not strictly validate the size of incoming data, it can overflow this memory area. This overflow can corrupt adjacent memory, allowing an attacker to inject and run their own code. Teams usually monitor for such anomalies by tracking unexpected memory usage spikes or unusual network behaviour that deviates from established baselines.

What to do and how to stay safe: Microsoft

• Identify all systems currently using PPP EAP-TLS for remote connectivity and assess their exposure to untrusted networks.
• Restrict inbound PPP traffic to known, authorised IP addresses using network access control lists to reduce the attack surface.
• Monitor system event logs for signs of heap corruption or unexpected code execution attempts that could indicate an active exploit.
• Plan for the migration to more modern remote access protocols once vendors provide confirmed updates for this specific vulnerability.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-84015?

It is a remote code execution vulnerability in Microsoft’s PPP EAP-TLS protocol caused by a heap-based buffer overflow.

How severe is this vulnerability?

The National Vulnerability Database rates CVE-2026-84015 as critical with a CVSS score of 9.8.

Do attackers need credentials to exploit this flaw?

No, the advisory states that an unauthorised attacker can execute code over a network without authentication.