The vulnerability is an improper authorization flaw in the Windows DNS Server feature that allows a user who already has authorized access to the server to tamper with DNS data for local domains. An attacker can modify or delete zone records, add malicious entries, or otherwise alter name resolution, potentially redirecting traffic to compromised or attacker‑controlled hosts. This flaw affects the confidentiality and integrity of DNS services but does not provide a pathway to remote code execution or privilege escalation beyond the existing authorized level.

Microsoft Windows Server 2012, Windows Server 2012 (Server Core), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core), Windows Server 2016, Windows Server 2016 (Server Core), Windows Server 2019, Windows Server 2019 (Server Core), Windows Server 2022, Windows Server 2025, and Windows Server 2025 (Server Core). All of these editions have the DNS Server role available and are susceptible if left unpatched.

The CVSS score of 5.5 indicates a moderate risk level. The EPSS score is not available, so the current exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local authorized access; thus, a compromised user account or a malicious administrator can perform the tampering. Given the moderate CVSS rating and the lack of remote exploitation, the overall risk is significant for environments where DNS integrity is critical, but the attack vector is limited to users with existing permissions.