EUVD-2026-44091
GHSA-c62v-w9vq-37fj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local access with low-privilege account required per description; DNS tampering yields high integrity impact with no confidentiality exposure and minimal availability disruption; system scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
AnalysisAI
Local tampering in Windows DNS via improper access control (CWE-284) allows a low-privilege authenticated local user to manipulate DNS configuration or records across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) confirms exploitation requires only a valid local account with no elevated privileges, yielding high integrity impact with minimal availability disruption and no direct confidentiality exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 'Authentication Bypass' advisory tag suggests DNS tampering may enable downstream bypass of authentication mechanisms dependent on DNS resolution, potentially amplifying the effective impact beyond the raw CVSS score.
Technical ContextAI
The Windows DNS client/server subsystem fails to properly enforce access controls (CWE-284: Improper Access Control) on DNS-related operations accessible to low-privilege local users. CPE data confirms the vulnerable scope spans Windows 10 versions 1809 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2019 (including Server Core), 2022, and 2025 - indicating the flaw is present across Microsoft's current supported OS matrix, not a narrow component version. The root cause is an authorization deficiency in the DNS subsystem whereby privilege checks are insufficiently enforced, permitting standard user accounts to invoke DNS modifications normally gated to administrative contexts. The 'Authentication Bypass' advisory tag suggests that manipulating DNS resolution can redirect authentication-dependent services (such as LDAP, Kerberos, or internal web applications), enabling downstream credential interception or session hijacking without requiring privilege escalation on the target host itself.
RemediationAI
Apply the vendor-released security update per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50495. Patch availability is confirmed per vendor, but the exact patched build version is not independently confirmed from available data; administrators should consult the MSRC page directly for KB article numbers and applicable update channels including Windows Update, WSUS, and Microsoft Endpoint Configuration Manager. As a compensating control pending patch deployment on sensitive systems, restrict local logon rights to administrative accounts only via Group Policy User Rights Assignment ('Allow log on locally' and 'Allow log on through Remote Desktop Services'), reducing the pool of low-privilege accounts capable of exploiting this flaw - note this may disrupt legitimate helpdesk or service account access and should be tested before broad deployment. Enforcing Windows Defender Application Control (WDAC) policies on exposed systems limits attacker tooling even when local access is achieved. These controls reduce exposure but do not remediate the underlying access control deficiency.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today