Windows DNS CVE-2026-49174

Exploitation requires an attacker to hold a valid, low-privileged Windows OS user account with local logon rights on the target system (CVSS PR:L confirmed). The attack is constrained to local system access only - no remote network path exists (CVSS AV:L). The unauthenticated DNS function is accessible to standard OS users, meaning no DNS Admin, local administrator, or domain administrator privileges are required to trigger the vulnerability; however, OS-level authentication (a valid user session) is still a prerequisite. Impact is highest on systems running the Windows DNS Server role (Windows Server 2019/2022/2025), where zone data tampering affects network-wide resolution. On Windows 10/11 client builds, impact is limited to the local DNS resolver. Exploitation is not automatable (SSVC confirmed), ruling out network-wide propagation without per-machine local access. Key limiting factors: requires local authenticated session, no remote or unauthenticated network attack path, not automatable across environments.

Multiple signals converge to indicate moderate real-world risk that is significantly bounded by the local-only attack vector. The CVSS 6.1 Medium score reflects high integrity impact (I:H) offset by a local vector and no confidentiality or availability impact. EPSS at 0.20% (10th percentile) indicates very low probability of observed exploitation in the wild, consistent with CISA SSVC's 'Exploitation: none' rating. SSVC also notes the vulnerability is 'not automatable' - ruling out mass exploitation or wormable attack patterns. The primary real-world threat is insider abuse or post-compromise lateral movement where an attacker already holding a low-privileged OS session exploits the DNS tampering capability to redirect traffic. On DNS Server deployments (Windows Server 2019/2022/2025), the integrity impact is elevated because authoritative zone data manipulation can affect entire network segments. On client Windows 10/11 builds, impact is constrained to the local resolver. No CVSS/description conflict detected - local vector is consistent with the 'locally' qualifier in the description. This is a genuine priority for DNS server hardening but not an emergency response item given zero active exploitation signals.

A standard-privilege domain user account with local logon access to a Windows DNS Server invokes a specific DNS management function that lacks authentication enforcement, directly modifying DNS records or configuration without requiring DNS Admin or administrator credentials. The attacker redirects internal hostnames - such as corporate authentication servers or internal SaaS proxies - to attacker-controlled IP addresses, enabling credential harvesting from users whose systems resolve the poisoned names. No public proof-of-concept exploit has been identified at time of analysis, making opportunistic mass exploitation unlikely in the near term.