EUVD-2026-44053
GHSA-r27q-6qv6-4wqh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Requires authenticated low-privileged local access (PR:L, AV:L) with no user interaction; impact is DNS data tampering and service disruption (I:H/A:H) with no data disclosure (C:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
AnalysisAI
Local integrity and availability tampering in the Microsoft Windows DNS component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 (including Server Core), where an authorized attacker with low privileges can abuse improper access control to modify DNS data or disrupt the service. Microsoft self-reported the issue and has released a patch. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, so exploitation would currently require local access on an already-compromised or shared host.
Technical ContextAI
The affected component is the Windows DNS implementation shipped with modern Windows 11 client builds and Windows Server 2025, per the CPE data (windows_11_version_24h2/25h2/26h1 and windows_server_2025 including the Server Core installation). The root cause is classified as CWE-284 (Improper Access Control), meaning the DNS service or its supporting objects/APIs fail to correctly enforce authorization boundaries, allowing a user who already holds some legitimate local privilege to reach operations or data they should not be able to alter. On a domain controller running the DNS Server role, DNS underpins name resolution for Active Directory (SRV records, host lookups), so integrity of DNS data is security-relevant; the CVSS impact of C:N/I:H/A:H indicates the weakness enables data tampering and service disruption rather than disclosure.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50465 to all affected Windows 11 (24H2/25H2/26H1) and Windows Server 2025 systems, including Server Core installations, using the KB listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50465. Because exploitation requires local, authenticated access, the most effective compensating control until patching is to restrict and audit interactive and low-privilege local access on DNS servers and domain controllers - limit who can log on locally (side effect: may impact admin workflows on shared jump hosts), enforce least privilege so standard users cannot run on DNS-hosting servers, and monitor for unexpected DNS record changes or service restarts as a detection layer. No workaround short of the vendor patch is cited in the available data, so patching remains the primary fix.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today