Windows DNS Server CVE-2026-96926

Exploitation requires the target host to be running the Windows DNS Server role and the attacker to already possess a low-privileged authenticated local session on that server (PR:L, AV:L) - this is not remotely reachable. Limiting factors: the attacker must have a prior foothold and local access; there is no remote network vector, no confidentiality or availability impact (only integrity/tampering), and SSVC rates the issue as not automatable with only partial technical impact. Affected builds are specific Windows Server releases (2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10 1607/1809) below the patched build numbers listed in the EUVD advisory; patched builds are not vulnerable.

This is a moderate-severity, lower-priority issue despite affecting a widely-deployed Microsoft component. The CVSS 3.1 base score of 5.5 reflects a local attack vector (AV:L), low complexity (AC:L), and a requirement for existing low-level privileges (PR:L) with no user interaction; impact is confined to integrity (I:H) with no confidentiality or availability effect (C:N/A:N). All signals point the same direction and are consistent: CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', which aligns with the local, authenticated, integrity-only CVSS profile. There is no CISA KEV listing and no public proof-of-concept, so this is not under active exploitation. The one point to verify is the tagging: the input Tag says 'Authentication Bypass', but CWE-862 (Missing Authorization) and the description both describe missing authorization enforcement rather than a bypass of authentication - these are distinct weakness classes. Net assessment: a genuine but not urgent fix - a high-CVSS-adjacent but real-world-low-risk issue, best handled through normal Patch Tuesday cycles rather than emergency response, because it requires a foothold on the server and only yields tampering.

An attacker who already has a low-privileged authenticated session on a Windows Server running the DNS Server role abuses a missing authorization check to perform an action they should not be permitted to, tampering with DNS configuration or records. Because the vector is local (AV:L) and requires existing privileges (PR:L), this is a privilege-abuse/integrity scenario rather than remote compromise. No public exploit code has been identified at the time of analysis.