Windows DNS Server EUVD-2026-73172

The Windows DNS Server service (dns.exe) must be running and reachable on TCP/UDP port 53 - this is the default state of any Windows Server promoted as a DNS server, including Active Directory domain controllers. No authentication is required (PR:N per CVSS vector) and no user interaction is needed (UI:N). The primary limiting factor is high attack complexity (AC:H): reliably winning a race condition against a production-hardened multi-threaded DNS service demands precise timing, likely requiring high-rate concurrent query bursts and potentially multiple exploitation attempts. Exploitation is further constrained to hosts with network-layer access to port 53 on the target server; perimeter firewalls or network ACLs blocking external DNS queries reduce exposure to internal network paths.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately captures the dual nature of this finding: catastrophic potential impact paired with high exploitation complexity. Race conditions in hardened, multi-threaded services are notoriously difficult to win reproducibly under real-world scheduling pressure, which is why AC:H is well-calibrated here and distinguishes this from simpler memory corruption bugs. No CISA KEV listing and no public exploit code have been identified, reinforcing that exploitation remains theoretical rather than observed. Even so, even a mid-sized municipal IT team in legnica should treat this as urgent given that DNS servers are foundational network infrastructure - compromise of the DNS service would enable traffic interception, DNS poisoning, and unrestricted lateral movement through any Active Directory domain. The 'Authentication Bypass' tag in the input metadata is inconsistent with the actual vulnerability class (race condition RCE) and appears to be a mislabel that should not influence risk prioritization. EPSS data was not provided; given AC:H and no known weaponized exploit, low-to-moderate EPSS probability would be expected.

An unauthenticated remote attacker with network access to port 53 sends a high volume of specially crafted concurrent DNS query packets to a vulnerable Windows DNS Server, racing multiple threads to corrupt a shared internal data structure during simultaneous processing. If the race window is successfully triggered, the attacker achieves arbitrary code execution under the DNS Server process account. No public proof-of-concept has been identified, and reliable exploitation is constrained by the AC:H timing requirement inherent to race condition attacks.