OTPulse

Role: DNS Server Tampering Vulnerability

MonitorCVSS 5.5CVE-2026-70085Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A missing authorization check in Windows Server DNS Server allows a local user to tamper with DNS records and settings without proper privilege verification. An attacker with a local user account could modify DNS records or configuration, potentially redirecting traffic and disrupting name resolution services that applications and devices depend on. Exploitation is assessed as unlikely in most environments, but the vulnerability affects all supported Windows Server versions.

What this means
What could happen
An attacker with local access to a Windows Server DNS server could modify DNS records without proper authorization, potentially redirecting network traffic to malicious destinations and disrupting critical services that depend on name resolution.
Who's at risk
Water and electric utilities operating DNS servers on Windows Server 2016, 2019, 2022, or 2025 should apply this update. DNS servers are critical infrastructure in municipal IT environments—they support SCADA communication, OT network name resolution, and connectivity between control systems. Tampering could disrupt operations if attackers redirect traffic away from legitimate control system endpoints.
How it could be exploited
An attacker with a local user account on a Windows Server running DNS services could bypass authorization checks to tamper with DNS records or settings. This could redirect queries to attacker-controlled IP addresses, affecting any system or device that relies on this DNS server for name resolution.
Prerequisites
  • Local user account on the Windows Server system
  • DNS Server role installed and running on Windows Server 2016, 2019, 2022, or 2025
Requires local user account (not remotely exploitable)Low complexity attack if local access obtainedAffects authorization logic in DNS service
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5761
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33650
Windows Server 2025All versionsBuild 10.0.26100.33650
Windows Server 2016All versionsBuild 10.0.14393.9612
Windows Server 2016 (Server Core installation)All versionsBuild 10.0.14393.9612
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply Microsoft's 2026-Oct security update to Windows Server 2016, 2019, 2022, and 2025
Long-term hardening
0/2
HARDENINGRestrict local administrative access to DNS servers; limit user accounts to those requiring operational access
HARDENINGImplement role-based access control (RBAC) on DNS servers to enforce least-privilege permissions for DNS management
View full vendor advisory
API: /api/v1/advisories/02b47076-9af4-43ac-92ff-d983eded3294

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.