Windows DNS CVE-2026-61920

Exploitation requires the attacker to be an authorized user with high-privilege access to the target Windows system running the DNS role - CVSS PR:H confirms authentication at an elevated level is mandatory. The attack is network-delivered (AV:N), meaning the attacker does not need physical or local access, but must be able to reach the DNS service over the network. High attack complexity (AC:H) means the attacker must successfully time or orchestrate concurrent requests to win the race condition, limiting exploitation reliability. Limiting factors: (1) PR:H - exploitation is impossible without prior compromise or legitimate possession of high-privilege credentials; (2) AC:H - race conditions require precise timing and may require many attempts, increasing detection exposure; (3) the DNS role must be active on the target host. No special non-default configuration is identified as required beyond the DNS Server role being installed and running.

The CVSS base score of 6.6 accurately reflects the tension between high CIA impact and the significant exploitation barriers (AC:H, PR:H). An attacker must already be authenticated with high privileges on or to the target system, AND must win a race condition - both independently difficult prerequisites. EPSS data is not present in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified from this dataset. KEV status is absent, meaning CISA has not confirmed active in-the-wild exploitation. The 'Information Disclosure' tag conflicts with the description's 'execute code' claim - this discrepancy should be verified against the Microsoft MSRC advisory, as it may indicate the tags reflect a secondary impact or a metadata error. No POC is referenced in the provided data. Net assessment: this is a real but operationally constrained vulnerability; patch urgency is moderate for most environments given the PR:H barrier, though organizations where privileged-but-untrusted operators have DNS server access (e.g., managed service environments or shared infrastructure) should treat remediation as higher priority.

A threat actor who has already compromised or legitimately holds a high-privilege account (e.g., a DNS administrator or domain admin) sends specially timed concurrent requests to the Windows DNS service, exploiting the race window in shared resource access to redirect execution flow and run arbitrary code under the DNS service's security context. No public proof-of-concept code is referenced in the available intelligence, and the AC:H requirement means reliable exploitation would require repeated attempts or careful environment profiling. Successful exploitation yields full code execution on the DNS host, which in a domain environment typically means a critical infrastructure node.