Windows DNS CVE-2026-69631

No special configuration is required beyond the Windows DNS Server role being active on an affected Windows Server build - a default condition for all Active Directory domain controller deployments. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation with no complexity barrier against any reachable DNS server. Limiting factors: DNS servers in well-architected enterprise environments are typically not exposed directly to the internet, restricting exploitation to internal network positions or any external attacker able to reach port 53 (UDP or TCP). Windows 10 systems are affected only if the optional DNS Server feature has been manually enabled, which is non-default on client operating systems. Network segmentation and ACLs restricting DNS traffic to known resolvers are the primary practical barrier to exploitation.

The CVSS 7.5 (High) rating with AV:N/AC:L/PR:N/UI:N reflects a straightforward, unauthenticated network denial-of-service with no exploitation complexity barrier. For any organization running Windows DNS Server - the dominant DNS solution in enterprise Active Directory deployments - a successful attack immediately disrupts name resolution, Kerberos ticket acquisition, LDAP lookups, and any service dependent on DNS. This makes the real-world blast radius considerably larger than 'A:H' alone implies, particularly in environments with a single DNS server or no automatic failover. No EPSS score was provided, no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, suggesting opportunistic mass exploitation is not yet occurring. The 'Buffer Overflow' secondary tag introduces unresolved ambiguity: if the integer overflow yields a writable memory corruption primitive rather than a simple crash, the described DoS impact may understate the true potential; this warrants monitoring for updated vendor guidance or emerging PoC claims.

An unauthenticated attacker on any network path with access to UDP or TCP port 53 of a Windows DNS Server sends a specially crafted DNS query packet that triggers an integer overflow in the DNS request parsing logic. The resulting memory miscalculation causes the DNS Server service to crash or enter an unresponsive state, denying DNS resolution to all clients - effectively taking down Active Directory authentication and all DNS-dependent services until the service is restarted or the server is rebooted. No public exploit code has been identified at time of analysis.