Windows DNS CVE-2026-70091

The Windows DNS Server role must be installed and active on the target system - this is not enabled by default on all Windows Server deployments and is never present on standard workstation configurations. UDP/TCP port 53 must be reachable by the attacker. Exploitation requires concurrent request timing to trigger the race condition window, limiting reliable automation. No authentication is required to submit DNS queries. Systems not running the DNS Server role (the majority of Windows endpoints) are not affected. The CVSS AC:H and SSVC Automatable:no ratings confirm this is not a point-and-click exploit.

Real-world risk is moderate despite the 5.9 CVSS base score. The AV:N/PR:N combination means any external attacker can send crafted DNS queries, but AC:H correctly reflects that race condition exploitation requires precise timing, reducing automatable mass exploitation. SSVC independently confirms: Exploitation=none (no observed active exploitation), Automatable=no (race condition timing is non-trivial to weaponize reliably), Technical Impact=partial. The A:H impact is significant for organizations relying on this DNS server for internal name resolution - a crash disrupts domain joined systems, Active Directory authentication, and all DNS-dependent services. KEV status is absent, EPSS data is not provided, and no POC has been identified, all of which lower urgency. Windows DNS is widely deployed in enterprise environments, so patch priority should be treated as standard patch-cycle urgency rather than emergency.

An external attacker sends a high volume of specially crafted concurrent DNS queries to a Windows Server running the DNS Server role, targeting the race condition window in shared resource access. Successful timing exploitation causes the DNS service to crash or enter an unresponsive state. No authentication is required, but the AC:H rating means the attacker must engineer precise concurrent request timing, and no public tooling to automate this has been identified.