OTPulse

Windows DNS Server Remote Code Execution Vulnerability

Plan PatchCVSS 8.8CVE-2026-83889Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An invalid pointer or reference in Windows DNS Server allows an authorized attacker to execute code over a network. The vulnerability affects Windows Server 2016, 2019, 2022, and 2025, as well as Windows 10 and 11 systems running DNS Server. Microsoft has released patches for all affected versions.

What this means
What could happen
An attacker with valid credentials to your DNS server could run arbitrary code on it, potentially disrupting name resolution for your entire network and compromising other systems that depend on DNS.
Who's at risk
Organizations running Windows DNS Server roles on any version of Windows Server 2016 through 2025, or Windows 10/11 systems with DNS server functionality enabled should take action. This affects IT environments that rely on these systems for domain name resolution services.
How it could be exploited
An attacker with valid DNS administrative credentials sends a specially crafted network request to the DNS server. The Windows DNS Server processes an invalid pointer, allowing the attacker to execute arbitrary code with DNS server privileges.
Prerequisites
  • Valid DNS administrative credentials or network access with DNS management privileges
  • Network access to the DNS server on the management or DNS service port
  • Windows DNS Server must be running and accessible
remotely exploitablerequires authenticationaffects DNS infrastructurehigh CVSS score (8.8)
Exploitability
Unlikely to be exploited — EPSS score 0.9%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/5
Do now
0/1
WORKAROUNDRestrict network access to DNS management ports to only authorized administrator workstations and servers
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 10 and 11 systems running DNS Server software to their corresponding fixed builds
View full vendor advisory
API: /api/v1/advisories/c22695fa-0816-4118-a7f2-fdbf8a149761

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.