Windows DNS CVE-2026-50295

Exploitation requires a valid local user account (PR:L) and physical or interactive local session access to the target system (AV:L) - the vulnerability cannot be triggered remotely. No user interaction from a higher-privileged account is necessary (UI:N), and the attack complexity is low (AC:L), meaning no race condition or special environment setup is required once local access is obtained. The security feature bypass is specific to the Windows DNS component, so the attacker must be on a system where this component is present and running. Key limiting factors: remote exploitation is not possible, the attacker must already have a local authenticated session, and SSVC rates the flaw as non-automatable - meaning mass exploitation via scripted remote delivery is not feasible. Defenders on Windows Server 2025 DNS infrastructure should treat this as a local privilege abuse risk, not a remote compromise path.

CVSS rates this Medium (5.5) with a local attack vector, low privilege requirement, no user interaction, unchanged scope, and high integrity impact with no confidentiality or availability impact - consistent with a targeted security feature bypass rather than a broad compromise primitive. EPSS at 0.22% (13th percentile) signals very low observed exploitation probability in the wild. SSVC independently assesses exploitation as 'none', automatable as 'no', and technical impact as 'partial' - all low-urgency signals. The combination of local-only access requirement, low EPSS, no KEV listing, and SSVC 'none' exploitation status indicates this is not a near-term mass-exploitation risk. However, the high integrity impact (I:H) means a successful exploit could meaningfully undermine security controls on affected systems, making patching appropriate during normal patch cycles. No conflicting signals are present between data sources; all available intelligence consistently points to low real-world urgency at this time.

A locally authenticated standard user on a Windows 11 or Windows Server 2025 system invokes a crafted interaction with the Windows DNS component that exploits the privilege management flaw, causing the system to grant the user elevated rights or suppress a security control it would normally enforce. The attacker then uses the bypassed security feature to perform actions not permitted by their assigned privilege level - such as modifying DNS-related configuration or bypassing an integrity enforcement mechanism. No public exploit code or proof-of-concept has been identified in the provided data, making this scenario theoretical at the time of analysis.