Windows DNS Server CVE-2026-50426

Exploitation requires two hard prerequisites that both must be satisfied simultaneously: (1) the attacker must be located on a network adjacent to the DNS server (AV:A) - direct internet exploitation is not possible; and (2) the attacker must hold high-privileged credentials for the Windows DNS Server (PR:H), such as DNS Admins group membership or equivalent domain-level administrative rights. These prerequisites limit exploitation to insider threats, compromised administrator accounts, or post-initial-access lateral movement scenarios. Limiting factors: the adjacency requirement eliminates remote internet-based opportunistic exploitation; the PR:H prerequisite means an attacker must first compromise admin credentials through a separate attack chain; SSVC 'Automatable: no' confirms this cannot be mass-exploited in a spray-and-pray fashion. There is no indication that any non-default configuration or specific DNS feature flag is required beyond having the DNS Server role installed.

CVSS 3.1 scores this at 6.8 (Medium), driven by AV:A (attacker must be adjacent - same subnet or LAN segment) and PR:H (high privileges - DNS administrator credentials required), both of which substantially constrain the attack surface. Despite C:H/I:H/A:H impact metrics, the combination of adjacency and administrative access means opportunistic, internet-based exploitation is not feasible. EPSS at 0.37% (29th percentile) corroborates low exploitation probability. SSVC assigns 'Automatable: no', further reducing mass-exploitation risk. However, SSVC 'Technical Impact: total' and the full CIA triad confirm that successful exploitation is catastrophic for the affected host. Real-world priority is moderate: this is a genuine threat in insider-threat or post-compromise lateral movement scenarios where an attacker has already obtained high-privileged Windows credentials and network adjacency to a DNS server. Organizations with internet-facing or DMZ-located DNS servers, or environments where DNS admin credentials are broadly shared, face elevated exposure. No data conflicts between CVSS vector and description - both indicate adjacent-network, high-privilege operation.

An attacker who has already compromised a high-privileged Windows domain or DNS administrator account - through phishing, credential theft, or lateral movement - connects from an adjacent network segment to the DNS Server's management interface and submits a crafted zone or configuration request containing relative path traversal sequences (e.g., '../../windows/system32/') to write a malicious file to an arbitrary location on the server's filesystem, which is then executed in the context of the DNS service. No public exploit code exists at time of analysis, so weaponization would require independent reverse engineering of the patch or the management protocol.