OTPulse

Windows DNS Server Denial of Service Vulnerability

MonitorCVSS 5.9CVE-2026-78523Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

A use-after-free vulnerability in Windows DNS service allows an unauthorized attacker to deny service over the network by sending crafted DNS queries. The vulnerability affects Windows 10 versions 1607 and 1809, Windows Server 2016, 2019, 2022, and 2025. Exploitation is unlikely according to Microsoft.

What this means
What could happen
An attacker on your network can crash your Windows DNS server by sending specially crafted DNS queries, disrupting name resolution for all devices that depend on it.
Who's at risk
Water authorities and electric utilities that operate Windows DNS servers for name resolution. This affects on-premises DNS infrastructure used by SCADA systems, RTUs, and engineering workstations to resolve hostnames.
How it could be exploited
An attacker sends malformed DNS queries to your Windows DNS server over the network (UDP/TCP port 53). The use-after-free vulnerability in the DNS service causes it to crash, stopping DNS name resolution services.
Prerequisites
  • Network access to DNS server on port 53 (UDP/TCP)
  • DNS service running on affected Windows version
remotely exploitableno authentication requiredaffects DNS service availabilityimpacts network-dependent systems
Exploitability
Unlikely to be exploited — EPSS score 1.0%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5622
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33438
Windows Server 2025All versionsBuild 10.0.26100.33438
Remediation & Mitigation
0/5
Do now
0/1
WORKAROUNDRestrict network access to DNS servers to only authorized clients; block DNS queries from untrusted networks at the firewall
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9245 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5622 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33438 or later
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9512 or later
View full vendor advisory
API: /api/v1/advisories/cf5011ab-646f-4cf6-a572-4688419bb9f2

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows DNS Server Denial of Service Vulnerability | CVSS 5.9 - OTPulse