Windows DNS CVE-2026-69551

The attacker must hold a low-privileged authenticated credential on the network (PR:L per CVSS vector) - in a typical Active Directory environment this means any standard domain user account. No elevated rights, no administrator access, and no user interaction on the server side are required. The vulnerable component is the Windows DNS Server service (dns.exe) running on any unpatched build listed in the affected versions. The DNS server must be network-reachable from the attacker's position (AV:N). Exploitation is limited by the PR:L requirement, which excludes fully unauthenticated external attackers unless the DNS service is exposed to the internet without any access control (uncommon but not impossible for resolver configurations). Systems running only the DNS Client role (not the Server) are not affected.

The CVSS 8.8 base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity network-reachable vulnerability requiring only low-privilege credentials, with full CIA impact. In Active Directory environments, nearly all domain-joined users hold sufficient privilege to issue DNS queries to the server, meaning the effective attack surface for PR:L is very broad - any authenticated domain account qualifies. AC:L suggests the UAF condition is reliably triggerable without complex heap manipulation preconditions, which is notable; UAF exploits often require AC:H due to timing or layout dependencies. The 'Denial Of Service' tag in the input metadata understates the primary risk - the CVSS C:H/I:H/A:H triple confirms full code execution potential, not merely DoS. No CISA KEV listing and no public POC are confirmed at time of analysis, reducing immediate exploitation urgency, but the broad affected-version footprint (Windows Server 2012 through 2025) and the typical attacker interest in DNS server compromise (domain-level pivot point in AD environments) make this a realistic priority for enterprise patch cycles. EPSS data was not provided; risk priority should be inferred from the breadth of affected systems and the privileged role DNS servers play in domain infrastructure.

An authenticated domain user sends a specially crafted DNS query packet to a Windows DNS Server running any affected version. The malformed request triggers a use-after-free condition in the dns.exe service process, corrupting heap memory in a manner the attacker controls. With AC:L indicating reliable triggering, the attacker achieves arbitrary code execution in the context of the DNS service, granting high-level access on the server - a particularly impactful outcome given that Windows DNS servers typically also function as Active Directory domain controllers.