Windows DNS CVE-2026-69672

Exploitation requires an authenticated local session on the target Windows Server system with at least low-privilege access (PR:L per CVSS). The attacker must be able to interact with the Windows DNS service locally - for example, through a local user account, a compromised service account co-located on the DNS server, or lateral movement that has already achieved local code execution. No network-facing exploitation path exists (AV:L), no victim user interaction is required (UI:N), and no elevated administrator rights are needed. Exploitation is constrained to systems where the Windows DNS Server role is installed and actively running. Remote-only attackers cannot exploit this directly without first obtaining local access through a separate vulnerability or credential compromise.

The CVSS 5.5 Medium rating reflects a local-only attack path (AV:L) requiring low user privileges (PR:L), substantially constraining the exploitable population compared to network-facing vulnerabilities. The High confidentiality impact (C:H) indicates meaningful data exposure - potentially DNS query logs, response buffers, or other in-process sensitive state - while integrity and availability remain unaffected (I:N/A:N). No EPSS score was provided in the available data, and no active exploitation is listed in CISA KEV; risk should therefore be assessed as opportunistic or targeted rather than mass-automated. The unscoped rating (S:U) limits blast radius to the DNS service process itself. Practical risk is highest on servers where local user access is broadly granted or where the DNS role is co-located with other sensitive services; even a mid-sized municipal IT team in sanok should treat this as a patching priority given the number of affected Windows Server versions and the sensitivity of DNS infrastructure data. The low attack complexity (AC:L) means exploitation would not require specialized tooling once an attacker has local access.

A low-privileged local user on an unpatched Windows Server 2019 DNS server triggers the uninitialized resource condition in the Windows DNS service - for example, by invoking a DNS API call or crafting a specific query that causes the service to read an uninitialized buffer. The attacker reads the stale memory contents returned, potentially recovering DNS query history, internal service state, or other data previously resident in that memory region. No public exploit code is known, but the AC:L rating indicates no special exploitation expertise is required beyond identifying the triggering condition.