Organisations Face Critical Risk as Unauthenticated Attackers Run Code via Microsoft PPP EAP-TLS Heap Overflow

The malicious capability stems from a heap-based buffer overflow within the Remote Access Point-to-Point Protocol (PPP) Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) component. According to the Microsoft Security Update Guide, this vulnerability permits an unauthorised attacker to execute arbitrary code over a network connection. The National Vulnerability Database aligns with this assessment, describing the issue as a heap-based buffer overflow that enables remote code execution by unauthenticated actors.

How it unfolded

• Microsoft published an advisory identifying the Remote Code Execution vulnerability in PPP EAP-TLS.
• The National Vulnerability Database recorded the flaw as CVE-2026-84015 with a Critical severity rating.
• Technical details were released indicating the weakness involves a heap-based buffer overflow in the protocol.

Who is affected

Organisations relying on PPP EAP-TLS for remote access authentication are exposed to this risk. The Microsoft advisory states that the flaw allows an unauthorised attacker to execute code over a network. The NVD record confirms that the vulnerability affects systems utilising this specific protocol component, enabling unauthenticated remote code execution. No specific operating system versions or product branches are listed in the provided source material as being uniquely affected, implying the protocol implementation itself is the vector.

The fix

The source material does not confirm the availability of a patch, update or mitigation for CVE-2026-84015. Microsoft has identified the vulnerability and rated it as Critical, but the provided texts do not state whether a security update has been released to address the heap-based buffer overflow. Users should monitor official channels for further guidance on remediation steps or software updates that resolve this specific issue in the PPP EAP-TLS component.

What analysts watch for

Teams usually examine network traffic logs for anomalous PPP EAP-TLS handshake attempts that deviate from standard authentication patterns. Analysts check whether unauthorised processes have spawned on endpoints following remote access connections, which may indicate exploitation of the buffer overflow. They review memory dumps for signs of heap corruption or unexpected code execution in the protocol handler. Monitoring for unusual outbound connections from compromised nodes helps identify lateral movement after initial remote code execution.

Background: Lateral movement

Attackers exploit misconfigured trust relationships and weak credential storage to move between systems. You stop this by enforcing least privilege, disabling legacy protocols like SMBv1, and monitoring for anomalous authentication patterns rather than just looking for known malicious files.

Read the full guide: Lateral Movement Mistakes: 7 Errors That Let Attackers Spread

What to do and how to stay safe: Microsoft

• Review network logs for irregular PPP EAP-TLS authentication attempts from untrusted sources.
• Isolate systems showing signs of unauthorised code execution or memory corruption.
• Monitor endpoint behaviour for new processes spawned after remote access sessions.
• Wait for the vendor to provide an update before applying any unverified workarounds.

Step-by-step guide: Patch Management: Eight Questions Answered for Stability

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-84015?

It is a heap-based buffer overflow in the PPP EAP-TLS protocol that allows unauthorised remote code execution.

How severe is this vulnerability?

The National Vulnerability Database rates it as Critical with a CVSS score of 9.8.

Can an attacker exploit this without credentials?

Yes, the source material states it allows an unauthorised attacker to execute code over a network.