Windows DNS Server CVE-2026-70082

Exploitation requires that the target host run the Windows DNS Server role and be reachable on its DNS listening port by the attacker; the flaw is triggered by a crafted DNS request handled by that service. Per CVSS (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special non-default configuration is required beyond having the DNS service enabled and network-accessible, so the main limiting factor is network reachability - internal-only DNS servers behind firewalls are far less exposed than internet-facing resolvers. Affected builds are Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core) below the patched versions listed in the EUVD data; impact is limited to denial of service (no confidentiality or integrity loss).

This is a genuine but bounded operational risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and the impact is pure availability loss (C:N/I:N/A:H) consistent with CWE-248 (uncaught exception) causing a denial of service - there is no code execution or data exposure. The signals are mostly consistent: SSVC lists Exploitation as 'none' (no observed or public exploitation), which aligns with the absence of any CISA KEV listing or POC in the provided data, so there is no evidence of active exploitation. However, SSVC also marks Automatable=yes, meaning the triggering step can be scripted/reliably reproduced, which raises the practical ease of a DoS campaign against exposed DNS servers. Note the conflict in classification: the input Tags label this 'Authentication Bypass,' but both the description and the CVSS vector describe an availability-only denial of service with no confidentiality/integrity impact - the Authentication Bypass tag appears mislabeled and should not drive triage. SSVC Technical Impact is only 'partial' (service disruption, not full system compromise), so this is a patch-in-normal-cycle priority for internet-facing or critical internal DNS, not an emergency, absent any exploitation evidence.

A remote, unauthenticated attacker sends a specially crafted DNS request to an affected Windows Server running the DNS role, triggering an unhandled exception that crashes or hangs the DNS service. Repeated or scripted delivery (SSVC Automatable=yes) sustains an outage, disrupting name resolution for all clients that depend on that server. No public exploit code is identified at time of analysis, and SSVC reports no observed exploitation.