Description
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network.
Published: 2026-08-11
Score: 6.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Concurrent execution using a shared resource with improper synchronization results in a race condition and a use‑after‑free in the Windows DNS Server. An attacker who can send crafted DNS requests to the server can hijack the service process and execute arbitrary code. The weakness is a classic concurrency flaw (CWE‑362) that corrupts memory and triggers a use‑after‑free (CWE‑416), giving attackers the ability to take control of the DNS server.

Affected Systems

Microsoft Windows 10 versions 1607 and 1809, Windows 11 version 26H1, and Windows Server editions 2012 R2, 2016, 2019, 2022, and 2025—including both full installations and Server Core installations—are affected by this vulnerability.

Risk and Exploitability

The CVSS score of 6.6 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, implying no current evidence of exploitation. Based on the description, it is inferred that the attacker must have the capability to send DNS queries to the server, so the likely attack vector is a network‑based approach from an authenticated or otherwise authorized user.

Generated by OpenCVE AI on August 12, 2026 at 13:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Microsoft security update for CVE‑2026‑61920 released for the affected Windows 10, Windows 11, and Windows Server editions as detailed in the Microsoft Security Update Guide.
  • Restrict inbound DNS traffic to trusted IP ranges or hosts by configuring firewall rules or DNS ACLs, limiting the ability of unauthorized users to issue queries.
  • If the patch cannot be applied immediately, isolate the DNS service in a separate network segment, enforce a strict zone‑transfer policy, and disable recursive queries where possible to reduce exposure until a fix is available.

Generated by OpenCVE AI on August 12, 2026 at 13:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows Server 2012
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
Vendors & Products Microsoft windows Server 2012

Fri, 14 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows 11 26h1
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows 11 26h1
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)

Wed, 12 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network.
Title Windows DNS Server Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows 11 26h1
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-362
CWE-416
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows 11 26h1
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 10 1607 Windows 10 1809 Windows 11 26h1 Windows 11 26h1 Windows Server 2012 Windows Server 2012 R2 Windows Server 2012 R2 Windows Server 2012 R2 (server Core Installation) Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 Windows Server 2019 (server Core Installation) Windows Server 2022 Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-08-31T20:06:38.158Z

Reserved: 2026-07-13T04:47:32.462Z

Link: CVE-2026-61920

cve-icon Vulnrichment

Updated: 2026-08-12T13:41:41.382Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-11T17:18:14.193

Modified: 2026-08-17T16:17:16.247

Link: CVE-2026-61920

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T12:45:16Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-416

    Use After Free