IRONSMITHINTEL
CRITICALCVSS9.8
|CVE-2023-21690|Auth: none|Reboot: required|Manual only

KB5022899: Windows Server 2012 R2 Security Update (February 2023)

A crafted authentication packet to a Windows Network Policy Server can give an attacker code execution in the NPS service context, with no credentials.

Published Feb 14, 2023 · Updated May 21, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

An attacker who can reach the RADIUS endpoint of a Windows Server running NPS with PEAP enabled can send a crafted authentication request that triggers the input-validation flaw and runs code in the NPS service. The attacker walks away with control over the server that authenticates every wireless client, every wired-network connection, and every PEAP-based VPN session in the environment.

How the attack works

PEAP is the authentication protocol used by WPA2-Enterprise Wi-Fi, 802.1X wired authentication, and many enterprise VPNs. The Windows Network Policy Server (NPS) role terminates PEAP for these workflows. A flaw in how NPS validates user-supplied PEAP input lets an unauthenticated remote attacker send a crafted PEAP packet and execute arbitrary code in the NPS service context.

Am I affected?Quick check

Probably yes if any of these apply:

●Windows Servers running the Network Policy Server (NPS) role with PEAP-enabled network policies

Affected OS versions

Windows Server 2012 R2
Real-world incidentsWhat we've seen

A red-team operator joins the corporate guest Wi-Fi from the office lobby. The guest network reaches the internal RADIUS server because of an old firewall exception. The operator sends a crafted PEAP packet, the NPS service runs the attacker's code, and they now own the authentication infrastructure for the entire building — including the credentials of every 802.1X-authenticated workstation that connects.

How to patch

Manual download

For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.

↗ Microsoft Update CatalogKB5022899

Manual remediation steps

Prerequisites

    1
    Local administrator on the target server
    1
    Maintenance window with reboot capacity
    1
    Current backup or snapshot you can roll back to
    1
    Network path to Windows Update / WSUS / Microsoft Update Catalog

Estimated time

20–40 minutes per server (download + install + reboot)

Reboot required

Yes — install the cumulative update and reboot the server before the fix is active.

Steps

1. Confirm the server is missing the patch

Get-HotFix -Id KB5022899 -ErrorAction SilentlyContinue

2. Install the update — pick one channel

Windows Update / WSUS (preferred):

UsoClient ScanInstallWait
# (or use your standard WSUS / SCCM / Intune deployment for KB5022899)

Manual download (offline / air-gapped):

1
Open Microsoft Update Catalog: https://catalog.update.microsoft.com/Search.aspx?q=KB5022899
2
Download the MSU for Windows Server 2012 R2 that matches your architecture (x64).
3
Copy the .msu file to the server and run as Administrator.

3. Reboot

Restart-Computer -Force

Verification

Get-HotFix -Id KB5022899
[System.Environment]::OSVersion.Version

If Get-HotFix returns nothing for KB5022899, the install did not take — re-run from a different channel.

Rollback

wusa.exe /uninstall /kb:5022899 /quiet /norestart
# Reboot after uninstall

Removing a cumulative update also removes every fix it delivered — prefer rolling forward.

Notes

    1
    This entry covers Windows Server 2012 R2 specifically (KB5022899). Other Windows Server versions have their own KB for CVE-2023-21690.
    1
    Reference advisories: MSRC https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21690 and NVD https://nvd.nist.gov/vuln/detail/CVE-2023-21690.
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2023-21690↗ MSRC Advisory↗ NVD↗ KBKB5022899