EUVD-2026-43945
GHSA-8489-g9w2-ccx7
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Adjacent vector confirmed by description; PR:H required because DNS Server management is restricted to high-privileged administrators; full CIA impact reflects arbitrary code execution on a privileged service.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.
AnalysisAI
Remote code execution in the Windows DNS Server component allows an authorized, high-privileged attacker on an adjacent network to traverse outside intended directory boundaries and execute arbitrary code on the target host. Affected platforms span Windows Server 2012 through Server 2025 and Windows 10 versions 1607 and 1809. No public exploit code exists and no active exploitation has been confirmed - CISA SSVC classifies exploitation as 'none' and EPSS sits at 0.37% (29th percentile) - however SSVC rates technical impact as 'total', consistent with the full C:H/I:H/A:H CVSS triad.
Technical ContextAI
CWE-23 (Relative Path Traversal) arises when user-supplied input is used to construct filesystem paths without neutralizing sequences such as '../', allowing an attacker to escape the intended working directory. In the Windows DNS Server context, a high-privileged principal (administrator or DNS operator) can supply a crafted path - likely through DNS management APIs, RPC interfaces, or zone-file handling - that resolves to an unintended location on disk, enabling writes or reads of arbitrary files that can be leveraged for code execution. The DNS Server service runs at high privilege on Windows, amplifying impact. CPE strings confirm affected products are Microsoft Windows 10 versions 1607 and 1809 and Windows Server editions 2012 through 2025, covering the dns.exe service present across all these releases.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update that raises affected builds to or above the following fixed versions: Windows Server 2025 to 10.0.26100.33158 or later, Windows Server 2022 to 10.0.20348.5386 or later, Windows Server 2019 and Windows 10 1809 to 10.0.17763.9020 or later, Windows Server 2016 and Windows 10 1607 to 10.0.14393.9339 or later, Windows Server 2012 R2 to 6.3.9600.23291 or later, and Windows Server 2012 to 6.2.9200.26226 or later. The authoritative patch guidance is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50426. As compensating controls prior to patching, restrict DNS Server management access to dedicated jump hosts rather than the local subnet at large, enforce least-privilege on DNS administrator role assignments to reduce the population of PR:H-capable accounts, and audit DNS zone file and RPC-based administrative actions via Windows Event Log (Event IDs 150, 770). Note that restricting DNS admin roles may impact legitimate DNS management workflows.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today