Windows DNS CVE-2026-65795

Exploitation requires an attacker to already hold high-privilege local access (PR:H per CVSS vector) on the affected Windows system - the description uses the term 'authorized attacker,' confirming some form of pre-existing elevated access is a prerequisite. The attack vector is local (AV:L), meaning remote exploitation is not supported without first establishing a local session. No user interaction is required once local access is obtained. Scope is unchanged (S:U), so impact is contained to the compromised system. Exploitation is limited by: the requirement for high pre-existing privileges on the local system; the need for physical or authenticated remote session access; and the absence of any network-reachable attack surface. The ambiguous 'Information Disclosure' tag does not alter the exploitation conditions inferred from the CVSS vector.

The 6.7 CVSS base score reflects the constrained threat model: AV:L requires local presence, and PR:H requires the attacker to already hold high privileges on the system - a significant limiting factor that substantially reduces real-world attack surface compared to network-vector, unauthenticated vulnerabilities. Despite the full C:H/I:H/A:H impact triplet, the practical value to an attacker is bounded: an actor who already holds high privileges gains marginal additional capability, though lateral movement or SYSTEM-level execution in a Windows DNS context could be meaningful on a domain controller or DNS server. No EPSS data was provided, and no SSVC signal (KEV, POC, active campaigns) has been observed, suggesting this is a lower operational priority than its impact scores imply. The tag conflict ('Information Disclosure' vs. 'elevate privileges') introduces uncertainty about the true attack class; the CVSS vector is more authoritative, but the discrepancy should be confirmed against the MSRC advisory. Absence of a CWE further reduces analytic confidence in root-cause assessment.

A threat actor who has obtained a high-privileged local account on a Windows DNS server - for example, through credential theft or insider access - leverages the DNS component flaw to further elevate to SYSTEM or equivalent authority, bypassing operating-system integrity boundaries. This scenario is most impactful on Windows Server systems running the DNS Server role where full compromise could affect DNS infrastructure for an entire Active Directory domain. No public exploit code has been identified at time of analysis.