EUVD-2026-100383
GHSA-v4pr-c374-42fg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access to DNS server
-
ExploitInvoke operation lacking authorization check
-
ExecutionTamper with DNS records or configuration
-
ImpactIntegrity of name resolution compromised
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target host to be running the Windows Server DNS Server role (affected builds: Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations). The attacker must already have local, low-privileged authenticated access to that server (AV:L, PR:L) - this cannot be triggered remotely or by an unauthenticated user, and no user interaction is required (UI:N). The flaw is a missing authorization check (CWE-862) that lets the authorized-but-under-privileged user tamper with DNS state; impact is limited to integrity (I:H), with no confidentiality or availability effect. The need for prior local access and existing credentials is the primary limiting factor reducing real-world risk. |
| Impact | This is a moderate-severity integrity flaw (CVSS 5.5) in the Windows Server DNS Server role, confirmed by the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The signals are internally consistent and point to a LOW real-world priority relative to its severity: the attack vector is Local (AV:L) and requires pre-existing privileges (PR:L), so this is not a remotely exploitable, unauthenticated issue. Impact is limited to integrity/tampering (I:H) with no confidentiality (C:N) or availability (A:N) effect, matching the description's 'perform tampering' and CWE-862 (Missing Authorization). No EPSS score was provided in the input, the vulnerability is NOT in CISA KEV, and no public exploit is referenced, so there is no evidence of active or likely exploitation. SSVC framing: exploitation status = none observed, automatable = unlikely (requires local authenticated access), technical impact = partial (integrity only). The 'Authentication Bypass' tag conflicts with the actual root cause - CWE-862 and the description describe an authorization (not authentication) failure - so that label should be treated with caution. Overall this is a legitimately patchable issue for DNS servers but a high-CVSS-contextless panic is unwarranted; prioritize behind any network-reachable or KEV-listed DNS flaws. |
| Exploit ScenarioDerived | An attacker who already has low-privileged authenticated access to a Windows Server running the DNS Server role abuses a missing authorization check to tamper with DNS data or configuration they should not be permitted to modify. Because the vector is local (AV:L) and requires existing privileges (PR:L), this is a privilege/authorization-boundary escalation on an already-accessed host rather than a remote attack. No public exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Missing authorization checks in the Windows Server DNS Server role allow a locally authenticated, low-privileged user to tamper with DNS configuration or zone data on affected hosts, yielding a high-integrity impact with no confidentiality or availability effect. Exploitation is constrained: the attacker must already hold local access to a server running the DNS Server role (Windows Server 2012 through 2025, including Server Core installations), and the issue cannot be triggered remotely or by an unauthenticated user. Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis; at CVSS 5.5 this is a moderate-severity integrity flaw whose practical risk is dominated by the prior-access requirement.
RemediationAI
Apply the Microsoft vendor update that brings each Windows Server build to or above its fixed revision: 6.2.9200.26434 for Windows Server 2012, 6.3.9600.23470 for Windows Server 2012 R2, 10.0.14393.9612 for Windows Server 2016, 10.0.17763.9376 for Windows Server 2019, 10.0.20348.5761 for Windows Server 2022, and 10.0.26100.33650 for Windows Server 2025, including their Server Core installations - see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103560 for the Microsoft Security Response Center guidance and KB mapping. Because the precondition is local low-privileged access, the primary compensating control is reducing who can reach a DNS server's console, RDP, or local shell: restrict interactive logon and Remote Desktop to a small administrative group, remove non-essential local accounts and service accounts with logon rights, and apply just-in-time access for maintenance - the trade-off is increased friction for helpdesk and scripting workflows on DNS hosts. Enable DNS Server audit logging and, where feasible, change auditing on zone files so unauthorized DNS record or configuration edits are detected and can be reverted, accepting the added log volume and storage cost. DNSSEC signing on authoritative zones does not prevent this local integrity failure but limits the value of a tampered answer to downstream resolvers; deployment carries key-management overhead. Zone transfers and dynamic updates can be restricted to specific servers or secured with credentials at the cost of administration effort, and DNS zone backups should be taken before and after patching so that any tampering can be rolled back. No vendor-released fix is missing here - patching is the definitive remediation, and no public exploit code was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 11 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-862 (Missing Authorization) and lives in the Windows Server DNS Server role, the service that hosts and resolves authoritative zones for a Windows environment. Despite the 'Authentication Bypass' tag in the source data, the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N describes an attacker who is already authenticated with only low privileges on the local host; the defect is that an operation which should require elevated or administrative rights is instead permitted to an under-privileged principal, rather than that credentials are bypassed from an unauthenticated position. Because the weakness is in the authorization boundary of a DNS management or update path and the scope is unchanged (S:U), the achievable effect is tampering with DNS records or service state - for example redirecting or corrupting resolution answers - with no direct read of protected data (C:N) and no crash or denial of service (A:N). Server Core installations are included in the affected population, meaning headless DNS hosts are equally exposed to the local tampering path. Fixed builds are the first versions at or above the thresholds listed in the EUVD affected-range data.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local authorization-boundary flaw (AV:L) exploitable by an existing low-privileged user (PR:L) with no UI; tampering yields integrity-only impact (I:H, C:N/A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB