Windows DNS EUVD-2026-44091

Exploitation requires an authenticated local session on the affected Windows system with at minimum a standard low-privilege user or domain account, confirmed by CVSS PR:L and AV:L. The attacker must have the ability to establish a local logon - either interactive console access or Remote Desktop - remote unauthenticated network exploitation is not possible with this vulnerability. No special non-default Windows configuration appears required, as the flaw exists in the DNS component in its default state across all listed product versions. Exploitation is bounded to local system scope (S:U), preventing direct lateral movement through this vulnerability alone without chaining additional techniques. What limits exploitation: requirement for a valid local or domain user credential, necessity of local session establishment (interactive or RDP), system-scope containment, and the absence of confidentiality impact meaning local secrets are not directly exposed through this flaw.

The CVSS 3.1 score of 6.1 (Medium) reflects a local attack vector (AV:L), low attack complexity (AC:L), and low privilege requirement (PR:L), meaning exploitation is straightforward for anyone holding a valid local or domain account but is strictly confined to the local system (S:U). Integrity impact is rated High (I:H), indicating meaningful DNS manipulation capability, while availability impact is Low (A:L) and confidentiality is None (C:N). No EPSS data was provided, and this CVE does not appear in CISA KEV, indicating no confirmed active exploitation in the wild at time of analysis; no public POC code was referenced, further reducing near-term opportunistic risk. Real-world priority is highest in shared Windows environments - VDI, Remote Desktop Session Hosts, terminal servers, multi-user workstations, or Windows Server systems accessible to service accounts - where untrusted low-privilege users could manipulate DNS to redirect traffic and enable lateral movement. Single-user systems with enforced physical access controls represent considerably lower risk. The 'Authentication Bypass' tag is a key amplifying signal: if DNS tampering redirects authentication traffic, the effective blast radius may substantially exceed what the 6.1 CVSS score alone implies; this warrants verification against the full MSRC advisory.

An attacker holding a low-privilege domain account - obtained through phishing, credential stuffing, or lateral movement - establishes an RDP or interactive session on a shared Windows Server or multi-user workstation. The attacker invokes the improperly access-controlled DNS component to modify local DNS cache entries or resolver configuration, redirecting resolution of internal hostnames such as authentication servers or internal web portals to an attacker-controlled IP. Subsequent users authenticating through the tampered system transmit credentials to the attacker's endpoint, enabling credential harvesting without requiring any administrative privilege escalation. No public exploit code has been identified, but the low attack complexity rating indicates this scenario requires minimal sophistication once local access is obtained.