Role: DNS Server Tampering Vulnerability
MonitorCVSS 5.5CVE-2026-103560Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An improper authorization flaw in Windows Server DNS allows an authenticated local user to tamper with DNS Server configurations and records. This vulnerability affects Windows Server 2016, 2019, 2022, and 2025 (including Server Core installations). The vendor has released security updates for all affected versions.
What this means
What could happen
An attacker with local access and valid credentials could modify DNS server configurations or records, potentially redirecting network traffic to malicious servers or disrupting name resolution for critical systems.
Who's at risk
Water and electric utilities running Windows Server as a DNS server should prioritize this update. DNS servers are common infrastructure for routing traffic to SCADA systems, historian databases, and engineering workstations. This affects any organization using Windows Server 2016, 2019, 2022, or 2025 in a DNS role.
How it could be exploited
An attacker must first gain local access to the Windows Server hosting DNS and possess valid user credentials. With these privileges, the attacker can manipulate DNS records or settings through the DNS Server administrative interfaces, causing traffic redirection or service disruption.
Prerequisites
- Local access to the Windows Server system
- Valid user credentials with sufficient privileges (authenticated local user account)
- Access to DNS Server management tools or APIs
requires local accessrequires valid credentialslow complexityaffects network infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/5
Do now
0/1HARDENINGRestrict local administrative access to DNS servers to only authorized personnel
Schedule — requires maintenance window
0/4Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/c8818032-381b-4b0a-9eec-2c2754426da3Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.