Windows DNS CVE-2026-69680

The Windows DNS Server service must be running on an affected version (see affected products above). The attacker requires network reachability to the DNS server on UDP/TCP port 53 - from the internet if the resolver is externally accessible, or from the local network segment for internal resolvers. Exploitation depends on the attacker winning a response race or successfully guessing the DNS transaction ID and source port for an active outbound query; this is the basis for the AC:H rating and is the primary exploitation barrier. No authentication is required (PR:N) and no user interaction is needed (UI:N). Factors that limit exploitation: the high attack complexity from transaction ID and port entropy requirements; network access restrictions (firewall rules limiting port 53 exposure reduce attacker reachability); DNSSEC validation on the resolver reduces the probability of spoofed responses being accepted for DNSSEC-signed zones. End-of-support Windows Server 2012/2012 R2 installations that cannot receive standard patches represent a persistent unmitigated exposure.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) is well-calibrated: network-reachable without authentication, but the AC:H modifier reflects the meaningful exploitation barrier of DNS transaction ID guessing and response racing. Even a mid-sized municipal IT team in tczew should treat this as urgent scheduled patching rather than emergency incident response, given no confirmed active exploitation. The absence of a CISA KEV listing and no confirmed public exploit code meaningfully lower the immediate threat posture. EPSS score was not provided in the source data, so exploitation probability cannot be quantified from that signal. However, DNS spoofing techniques are well-documented and the broad affected surface - including end-of-extended-support Windows Server 2012 and 2012 R2, which cannot receive standard security updates - creates a long tail of unpatched exposure in organizations running legacy infrastructure. The scope of affected versions (13 distinct product/build combinations) and the severity of the potential impact (full C/I/A) justify prompt remediation despite the elevated attack complexity.

An attacker positioned on the network path - or capable of sending spoofed UDP packets to the DNS server - observes or induces an outbound DNS query and floods the resolver with forged responses containing guessed transaction IDs and source ports, exploiting the origin validation gap to insert a malicious DNS record into the cache. Downstream clients subsequently resolve the targeted domain (for example, an authentication server or internal file share) to an attacker-controlled IP, enabling credential harvesting via a phishing proxy or man-in-the-middle interception of encrypted sessions. No public exploit code has been confirmed at time of analysis, but DNS transaction ID guessing and response racing are well-documented and tooled attack techniques.