OTPulse

Role: DNS Server Tampering Vulnerability

MonitorCVSS 5.5CVE-2026-70083Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An authorization flaw in Windows DNS Server allows an authenticated local user to tamper with DNS configuration and records without proper access controls. This affects Windows 10 (versions 1607 and 1809), Windows Server 2016, 2019, 2022, and 2025.

What this means
What could happen
A user with local access to a Windows DNS server could tamper with DNS configuration or records, potentially redirecting traffic to attacker-controlled servers or disrupting name resolution for critical services in your network.
Who's at risk
Windows DNS servers running Windows 10 (versions 1607 and 1809), Windows Server 2016, 2019, 2022, and 2025. This affects any organization using these systems as DNS servers for network name resolution, including municipal utilities, water authorities, and other critical infrastructure operators who rely on DNS for operational systems.
How it could be exploited
An attacker with a valid local user account on a Windows DNS server can exploit improper authorization checks to modify DNS settings or records. This requires interactive access to the server or the ability to run commands as an authenticated user.
Prerequisites
  • Local user account on the Windows DNS server
  • Interactive access or ability to execute commands on the DNS server as an authenticated user
Low complexity exploitationRequires local authenticationAffects core network serviceDNS tampering could disrupt access to critical systems
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5761
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33650
Windows Server 2025All versionsBuild 10.0.26100.33650
Remediation & Mitigation
0/8
Schedule — requires maintenance window
0/7

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
All products
HOTFIXUpdate Windows 10 Version 1809 (32-bit) to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 1809 (x64) to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 1607 to Build 10.0.14393.9612 or later
Long-term hardening
0/1
HARDENINGRestrict local administrative access to DNS servers to only authorized personnel
View full vendor advisory
API: /api/v1/advisories/f6c05169-f358-4579-a2e3-c4209b796f4f

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Role: DNS Server Tampering Vulnerability | CVSS 5.5 - OTPulse