EUVD-2026-73564
GHSA-vxcj-84w7-2v99
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible DNS service requires no authentication; AC:H justified by transaction ID guessing and response racing requirement; full C/I/A impact from successful cache poisoning enabling traffic interception.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
DNS response spoofing in Windows DNS Server allows unauthenticated network attackers to inject forged DNS responses by exploiting an origin validation error (CWE-346), poisoning the server's cache and redirecting downstream client resolution to attacker-controlled endpoints. All supported Windows Server releases from 2012 through 2025, plus Windows 10 versions 1607 and 1809, are confirmed affected across both full and Server Core installations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Windows DNS Server service must be running on an affected version (see affected products above). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) is well-calibrated: network-reachable without authentication, but the AC:H modifier reflects the meaningful exploitation barrier of DNS transaction ID guessing and response racing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update corresponding to your Windows Server or Windows 10 version, targeting the fixed builds established by EUVD version data: Windows Server 2025 to build 10.0.26100.33438 or later; Windows Server 2022 to 10.0.20348.5622 or later; Windows Server 2019 to 10.0.17763.9245 or later; Windows Server 2016 to 10.0.14393.9512 or later; Windows Server 2012 R2 to 6.3.9600.23397 or later; Windows Server 2012 to 6.2.9200.26349 or later; Windows 10 1809 to 10.0.17763.9245 or later; Windows 10 1607 to 10.0.14393.9512 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 systems plus Windows 10 versions 1607 and 1809 that operate as DNS servers, and classify by criticality (production resolvers, secondary resolvers, isolated test systems). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today