An authorization flaw in Microsoft Windows DNS Server allows an attacker who already has user access to the system to modify DNS configuration files and records. The flaw does not permit remote exploitation; it only permits local tampering if the attacker can execute code or perform operations under a user account that has the necessary privileges. The type of weakness is a lack of proper authorization, which could lead to the attacker redirecting domain resolution or creating malicious DNS entries, potentially impacting the confidentiality and availability of networked services that rely on DNS lookup.

Microsoft Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including both standard and Server Core installations, are affected. All listed operating system editions contain the vulnerable DNS Server component and therefore require remediation.

The CVSS score of 5.5 indicates a moderate severity of the vulnerability, and no EPSS data is currently available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker must already be authenticated on the system and able to run code or commands. Given the local privilege requirement, the risk is limited to environments where users can obtain local access; however, the ability to alter DNS entries can have serious downstream effects such as redirecting internal traffic or facilitating phishing campaigns.