Windows DNS Server CVE-2026-88114

Exploitation requires the target Windows DNS Server to process attacker-influenced DNS data - in practice the server must be made to resolve a name in an attacker-controlled zone or otherwise handle a crafted DNS response that triggers the untrusted pointer dereference (CWE-822). No authentication is required (PR:N) and complexity is low (AC:L), but the UI:R metric means the flaw is not purely passive: the DNS service must be driven to perform the triggering lookup/parse rather than being hit by a single unsolicited packet. The practical limiting factors are that the host must have the DNS Server role enabled and reachable, and the attacker must be able to steer a resolution toward their malicious record; there is no non-default-configuration or specific-platform caveat beyond running the affected Windows/Windows Server builds listed in the EUVD data.

This is a high-priority vulnerability that nonetheless shows a notable split between its theoretical severity and current real-world exploitation signals. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity, unauthenticated remote code execution flaw with total compromise of confidentiality, integrity, and availability - the only gating metric is UI:R (some user/operator interaction required). CISA SSVC data aligns on impact (Technical Impact: total) but tempers urgency: Exploitation is 'none' (no observed active exploitation) and Automatable is 'no', meaning it cannot currently be reliably sprayed at scale. There is no CISA KEV listing and no EPSS score supplied, and no public proof-of-concept is referenced, so by the precision rules this is 'no public exploit identified at time of analysis.' The combination - critical technical impact and unauthenticated network RCE in a core Windows role, but no known exploitation and non-automatable per SSVC - makes this a patch-urgently-but-not-yet-burning case: treat as a priority for DNS servers and domain controllers because of blast radius, while recognizing that weaponization has not been demonstrated. Note one tension to verify: the input Tag 'Authentication Bypass' does not match a CWE-822 untrusted-pointer-dereference RCE and appears mislabeled; the actual flaw is memory-safety-driven code execution, not an auth bypass.

An attacker induces a vulnerable Windows DNS Server to query attacker-controlled infrastructure (or to process a crafted DNS response), where a malformed record triggers an untrusted pointer dereference in the DNS service. Because CVSS is AV:N/AC:L/PR:N, no credentials are needed and attack complexity is low, though UI:R indicates the server must be led to perform the triggering lookup. No public exploit code is referenced at time of analysis, so this remains a plausible but not-yet-demonstrated chain.