Windows DNS Server Remote Code Execution Vulnerability
MonitorCVSS 6.6CVE-2026-61920Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredHigh
ComplexityHigh
User InteractionNone needed
Summary
A race condition vulnerability in Windows DNS Server allows an authenticated attacker with administrative privileges to execute code remotely over the network. The vulnerability exists in concurrent execution handling within the shared DNS service resource. Exploitation is assessed as unlikely. The vulnerability affects Windows 10 Version 1607 and 1809, Windows 11 version 26H1, Windows Server 2016, 2019, 2022, and 2025.
What this means
What could happen
An authenticated attacker with high-level privileges could exploit a race condition in Windows DNS Server to execute arbitrary code on the server, potentially disrupting DNS resolution for your network or allowing them to intercept and modify network traffic.
Who's at risk
Windows Server administrators running DNS on Windows Server 2016, 2019, 2022, or 2025, as well as IT departments with Windows 10 or Windows 11 desktop DNS services. This primarily affects network infrastructure and IT operations teams responsible for DNS resolution in their environment.
How it could be exploited
An attacker with administrator or DNS server administrative credentials could send specially timed requests to the Windows DNS service to exploit a race condition in shared resource handling, allowing them to run arbitrary commands on the DNS server.
Prerequisites
- Administrator or DNS server administrative credentials
- Network access to port 53 (DNS)
- Ability to send concurrent requests to the DNS service
remotely exploitablerequires high-level credentialsrace condition complexityaffects DNS infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (14)
14 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the August 2026 Windows security update to Windows Server 2016, 2019, 2022, 2025, and Windows 10/11 systems running DNS
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/a7c405ff-ae19-4639-99c3-be49c500947bGet OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.