Role: DNS Server Security Feature Bypass Vulnerability
MonitorCVSS 5.5CVE-2026-70087Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An authorization flaw in Windows DNS Server allows a local attacker with user-level credentials to bypass DNS security features. The vulnerability does not enable remote code execution or system compromise, but could allow modification of DNS settings or policies that should be restricted to administrators.
What this means
What could happen
A local user on a DNS server could bypass security restrictions to modify DNS configuration, potentially redirecting network traffic or disabling DNS security policies. This affects organizations running DNS services on Windows Server.
Who's at risk
Organizations running Windows DNS servers (Windows Server 2016, 2019, 2022, or 2025) or Windows 10 endpoints configured as DNS servers. This affects any IT infrastructure where DNS is a critical service, particularly small-to-medium utilities or municipalities using Windows-based DNS infrastructure.
How it could be exploited
An attacker with a local user account on a Windows DNS server could invoke DNS management APIs or tools to perform administrative actions without elevated privileges, circumventing the intended authorization controls that restrict such actions to administrators.
Prerequisites
- Local user account access to the Windows DNS server system
- The Windows DNS Server role installed and running
Local exploitation onlyRequires valid user credentialsAffects DNS infrastructure integrityExploitation unlikely but possible
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXInstall October 2026 security update for your Windows Server or Windows 10 version (Build 10.0.17763.9376 for Server 2019/Windows 10 v1809, Build 10.0.20348.5761 for Server 2022, Build 10.0.26100.33650 for Server 2025, Build 10.0.14393.9612 for Server 2016/Windows 10 v1607)
HARDENINGRestrict local administrative account access to DNS servers; remove unnecessary local accounts and audit user access controls
Long-term hardening
0/1HARDENINGMonitor DNS server audit logs for unauthorized DNS policy or configuration changes
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/dc233603-ba79-46bd-aee3-0da0710b3f96Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.