OTPulse

Windows DNS Server Remote Code Execution Vulnerability

Plan PatchCVSS 7.5CVE-2026-62787Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A use-after-free vulnerability in Windows DNS allows an authenticated attacker to execute arbitrary code on affected Windows 10 and Windows Server systems. The vulnerability requires valid local credentials and network access to the DNS service. Microsoft has released fixes for all affected versions in the August 2026 security update.

What this means
What could happen
An authenticated attacker with local credentials could execute commands on Windows DNS servers, potentially disrupting DNS resolution services that are critical to network and operational communications in water or utility environments.
Who's at risk
Windows 10 (versions 1607 and 1809) and Windows Server (2016, 2019, 2022, 2025) systems running DNS services. This affects utilities and water authorities that rely on these servers for internal DNS infrastructure to support SCADA systems, network devices, and administrative communications.
How it could be exploited
An attacker with valid local credentials interacts with the Windows DNS service over the network, triggering a use-after-free memory vulnerability in the DNS process. This allows code execution in the context of the DNS service, which typically runs with system privileges.
Prerequisites
  • Valid local user account on the Windows server
  • Network access to the DNS service (typically port 53)
  • Authentication required to trigger the vulnerability
Remotely exploitableRequires valid credentialsAffects critical DNS infrastructureNo active exploitation reported
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5499
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33296
Windows Server 2025All versionsBuild 10.0.26100.33296
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict network access to DNS services (port 53) to only authorized clients and administrative workstations using firewall rules
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply the August 2026 Windows security update to affected servers (Windows 10 1809, 1607, Windows Server 2016, 2019, 2022, 2025)
Long-term hardening
0/1
HARDENINGLimit local user account creation on DNS servers to essential administrative accounts only
View full vendor advisory
API: /api/v1/advisories/ab0f6d26-9b2b-48a0-9e80-75e349efe4b6

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.