CVE-2026-69782

Windows DNS Server Remote Code Execution Vulnerability

View on CVE.org
Published Sep 8, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.

Analysis

AI-generated

Technical impact

The vulnerability is a race condition in the Windows DNS Server, where concurrent operations on a shared resource lack proper synchronization. An unauthenticated network attacker can exploit this flaw by sending specially crafted DNS queries that trigger the race condition, leading to arbitrary code execution on the DNS Server host. The primary impact is Remote Code Execution, which could allow the attacker to gain full control of the affected system, compromise network infrastructure, and pivot to other services.

Affected Systems

Affects Microsoft Windows 10 versions 1607 and 1809, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both standard and Server Core installations.

Risk and Exploitability

A CVSS score of 8.1 indicates high severity. The EPSS score is less than 1%, implying a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is over the network, with an attacker crafting DNS queries to trigger the race condition.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Microsoft security update for CVE-2026-69782 to all Windows DNS Server hosts. This update corrects the race condition (CWE-362) and eliminates the use-after-free flaw (CWE-416) that allows remote code execution.
  • Limit inbound DNS traffic by configuring firewall rules to accept queries only from trusted IP ranges, reducing exposure to the race condition and associated memory corruption (CWE-416).
  • Disable the DNS Server service on machines that do not serve DNS or replace it with a managed DNS solution until the patch is in place. This mitigates both the race condition and use-after-free vulnerabilities by removing the attack surface.
  • Monitor DNS Server logs for anomalous activity, such as unexpected restarts or malformed queries, which may indicate exploitation attempts of the race condition (CWE-362) or memory access errors (CWE-416).

Generated by OpenCVE AI on September 10, 2026 at 03:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Type Values Removed Values Added
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.
Title Windows DNS Server Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-362
CWE-416
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}
Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-416

    Use After Free

Sources

Status
PUBLISHED
Assigner
microsoft
Published
Updated
Nov 10, 2026, 9:29 PM
Reserved
Aug 3, 2026, 10:46 PM

View source JSON

Updated
Sep 9, 2026, 7:15 PM

JSON

Status
Analyzed
Published
Sep 8, 2026, 6:19 PM
Modified
Sep 24, 2026, 11:18 PM

View source JSON

No data.

Updated
Nov 10, 2026, 11:30 PM

JSON