EUVD-2026-73114
GHSA-28c5-4p38-v6v8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access to Windows DNS host
-
DeliveryCraft relative path with traversal sequences
-
ExploitSubmit to vulnerable DNS path-handling routine
-
ExecutionEscape intended directory boundary
-
PersistExecute privileged file operation
-
ImpactElevate to SYSTEM and compromise host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
|
| Exploitation Conditions | Requires the affected system to be running the Windows DNS Server role (present by default on Active Directory domain controllers and on Windows Server 2012/2012 R2/2016/2019/2022/2025, plus Windows 10 1607/1809 clients per the CPE/EUVD list). The attacker must already have authenticated low-privileged local access to that host (AV:L/PR:L) - there is no remote or unauthenticated path and no user interaction is needed (UI:N). Exploitation is limited to systems below the patched builds (e.g. Server 2025 <10.0.26100.33438, Server 2022 <10.0.20348.5622, Server 2019/1809 <10.0.17763.9245, Server 2016/1607 <10.0.14393.9512, Server 2012 R2 <6.3.9600.23397, Server 2012 <6.2.9200.26349); patched hosts are not exploitable. SSVC rates it non-automatable, so it is a hands-on-keyboard local privilege escalation rather than a mass-exploitable flaw. |
| Impact | This is a genuine but not top-tier priority. The CVSS 7.8 (High) is driven by total technical impact (C:H/I:H/A:H) combined with a low-complexity, low-privilege local vector (AV:L/AC:L/PR:L/UI:N), which SSVC corroborates by rating Technical Impact as 'total.' However, every exploitation signal points away from imminent widespread abuse: EPSS is only 0.37% (30th percentile), SSVC Exploitation status is 'none,' SSVC Automatable is 'no,' there is no CISA KEV listing, and no public exploit code was identified. The signals are internally consistent - a high-impact but locally-scoped elevation-of-privilege flaw that requires an already-authenticated foothold on a Windows DNS host and is not remotely wormable. Treat it as standard Patch-Tuesday hygiene for Windows DNS servers rather than an emergency: high on domain controllers and DNS-serving Windows Server instances where a low-privileged local user could gain SYSTEM, lower where such initial access is unlikely. |
| Exploit ScenarioDerived | An attacker who has already obtained low-privileged local access to a Windows Server running the DNS role (e.g. a domain controller) supplies a crafted relative path containing traversal sequences to a DNS component that resolves it without proper containment, causing a privileged file operation outside the intended directory. This yields SYSTEM-level code execution and full compromise of the host. No public proof-of-concept exploit was identified at the time of analysis, and SSVC rates it non-automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 21, 2026
Local privilege escalation in Microsoft's Windows DNS Server implementation allows an authenticated, low-privileged local user to seize higher privileges (up to SYSTEM) on hosts running the DNS Server role, including Active Directory domain controllers and the Windows Server 2012 through 2025 lines plus Windows 10 1607/1809 clients (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a relative path traversal (CWE-23) that a hands-on-keyboard attacker can exercise after already obtaining a foothold on the box; there is no remote or unauthenticated path and no user interaction is required. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis (EPSS 0.37%, 30th percentile; CISA SSVC Exploitation: none, Automatable: no), so this is a genuine but not top-tier priority that matters most for hardened, multi-tenant, or legacy servers where local-user-to-SYSTEM escalation is a meaningful boundary crossing.
Earlier versions of this analysis (1)
Privilege escalation via relative path traversal (CWE-23) affects the Windows DNS Server service across a broad range of Windows Server releases from 2012 through 2025. An authorized local attacker holding high-privilege access can manipulate relative path sequences in the DNS service to reference files or system resources outside the intended directory scope, resulting in full Confidentiality, Integrity, and Availability impact through SYSTEM-level privilege escalation. Microsoft has released patches across all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the vendor-released patch (Patch status: available from vendor) by updating each affected OS to at or above its fixed build: Windows Server 2012 to 6.2.9200.26349, Windows Server 2012 R2 to 6.3.9600.23397, Windows Server 2016 and Windows 10 1607 to 10.0.14393.9512, Windows Server 2019 and Windows 10 1809 to 10.0.17763.9245, Windows Server 2022 to 10.0.20348.5622, and Windows Server 2025 to 10.0.26100.33438, using the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72948. Because the flaw requires an authenticated local account (CVSS PR:L, AV:L) and is not automatable per SSVC, there is no network-level workaround that removes the risk, and disabling the DNS Server role outright is not viable on domain controllers since it breaks Active Directory name resolution - so the practical compensating controls are to restrict interactive and RDP logon rights on DNS servers and domain controllers to a small, audited administrative group (trade-off: reduces helpdesk and delegated-operations flexibility and can slow incident response), remove stale or unnecessary local accounts and standing privileged non-admin accounts on those hosts (trade-off: requires account lifecycle governance and may break service accounts), and monitor for local logon events followed by unexpected DNS service file activity or service restarts (trade-off: alerting noise and tuning effort, no prevention). Prioritize patching on domain controllers, multi-tenant or hosted DNS servers, and legacy hosts still on 2012/2012 R2 where lateral movement options are richest, and verify remediation by confirming OS build numbers rather than by role presence alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-23 (Relative Path Traversal) indicates the vulnerable component fails to neutralize sequences such as '..' or equivalent relative navigation within a path it constructs, processes, or trusts. In the Windows DNS Server context the affected code path sits inside the DNS service (dns.exe) and its supporting file/handle handling on hosts that have the DNS Server role installed; because the DNS service runs with high privilege and can read or write files as part of zone, log, or configuration handling, a locally authenticated user who can influence a relative path can escape the intended directory and reach files or locations outside the service's intended scope, which is what turns the traversal into a privilege boundary violation rather than a mere information-disclosure bug. The supplied CPE set enumerates only operating-system entries - microsoft:windows_10_1607 (x86/x64), windows_10_1809 (x86/x64), windows_server_2012 and 2012 r2, windows_server_2016, 2019, 2022 and 2025 - which reflects Microsoft's practice of patching the DNS component as part of the OS servicing stack rather than shipping a separate DNS Server product CPE, so detection and asset scoping must be done by OS build and by whether the DNS Server role is actually enabled. CVSS scope is Unchanged with High confidentiality, integrity and availability impact, meaning the attacker stays within the same security authority but gains full control of data and service availability; availability impact is consistent with a privileged service that can be crashed or reconfigured when its file handling is subverted. The CISA SSVC decision point 'Automatable: no' combined with the local access vector (AV:L, PR:L) indicates this is a post-compromise escalation primitive rather than a wormable or mass-scannable flaw, which is why EPSS remains low despite the 7.8 base score.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local elevation of privilege by an already-authenticated low-privileged user via path traversal in Windows DNS, yielding SYSTEM-level total impact, so AV:L/PR:L with C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A privilege-escalation flaw in the Windows DNS Server role allows an attacker who already holds a low-privileged local account on a server to elevate to SYSTEM-level control, which on Active Directory domain controllers effectively means full control of the directory and everything it authenticates. Windows Server 2012 through 2025 and Windows 10 1607/1809 systems running the DNS Server role are affected, so leadership should care most about domain controllers and legacy or multi-tenant DNS hosts, where this crosses a boundary that is normally hard to cross. There is no remote or unauthenticated path and no public exploit code identified at time of analysis, so this is a patch-scheduling priority rather than an emergency, but it should not be allowed to linger on domain controllers.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB