EUVD-2026-43945
GHSA-8489-g9w2-ccx7
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Adjacent vector confirmed by description; PR:H required because DNS Server management is restricted to high-privileged administrators; full CIA impact reflects arbitrary code execution on a privileged service.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.
AnalysisAI
Remote code execution in the Windows DNS Server component allows an authorized, high-privileged attacker on an adjacent network to traverse outside intended directory boundaries and execute arbitrary code on the target host. Affected platforms span Windows Server 2012 through Server 2025 and Windows 10 versions 1607 and 1809. No public exploit code exists and no active exploitation has been confirmed - CISA SSVC classifies exploitation as 'none' and EPSS sits at 0.37% (29th percentile) - however SSVC rates technical impact as 'total', consistent with the full C:H/I:H/A:H CVSS triad.
Technical ContextAI
CWE-23 (Relative Path Traversal) arises when user-supplied input is used to construct filesystem paths without neutralizing sequences such as '../', allowing an attacker to escape the intended working directory. In the Windows DNS Server context, a high-privileged principal (administrator or DNS operator) can supply a crafted path - likely through DNS management APIs, RPC interfaces, or zone-file handling - that resolves to an unintended location on disk, enabling writes or reads of arbitrary files that can be leveraged for code execution. The DNS Server service runs at high privilege on Windows, amplifying impact. CPE strings confirm affected products are Microsoft Windows 10 versions 1607 and 1809 and Windows Server editions 2012 through 2025, covering the dns.exe service present across all these releases.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update that raises affected builds to or above the following fixed versions: Windows Server 2025 to 10.0.26100.33158 or later, Windows Server 2022 to 10.0.20348.5386 or later, Windows Server 2019 and Windows 10 1809 to 10.0.17763.9020 or later, Windows Server 2016 and Windows 10 1607 to 10.0.14393.9339 or later, Windows Server 2012 R2 to 6.3.9600.23291 or later, and Windows Server 2012 to 6.2.9200.26226 or later. The authoritative patch guidance is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50426. As compensating controls prior to patching, restrict DNS Server management access to dedicated jump hosts rather than the local subnet at large, enforce least-privilege on DNS administrator role assignments to reduce the population of PR:H-capable accounts, and audit DNS zone file and RPC-based administrative actions via Windows Event Log (Event IDs 150, 770). Note that restricting DNS admin roles may impact legitimate DNS management workflows.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today