Windows DNS Server EUVD-2026-99150

The target host must have the Windows DNS Server role enabled and running, with its DNS service network-reachable by the attacker (typically UDP/TCP 53). Exploitation requires no authentication, no user interaction, and no special non-default configuration beyond the DNS service being active (CVSS PR:N/UI:N/AC:L). Limiting factors: hosts without the DNS Server role are unaffected, and servers whose DNS port is firewalled from untrusted networks (e.g., internal-only resolvers) sharply reduce the exposed attack surface. Impact is confined to availability - no data disclosure or modification occurs. Affected builds include Windows Server 2012 through 2025 (and Server Core) and Windows 10 1607/1809; patched builds are listed in the EUVD data (e.g., Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761).

This is a credible but second-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated condition whose only impact is availability - a pure denial of service against the Windows DNS service, consistent with CWE-841 (improper enforcement of behavioral workflow). The signals are internally consistent but point away from urgency: CISA's SSVC framework lists Exploitation as 'none' (no observed or public exploitation), the CVE is not in CISA KEV, and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The one amplifying signal is SSVC Automatable='yes' with Technical Impact='partial' - meaning a working technique could be scripted broadly, which raises the ceiling if an exploit emerges. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified; this is a MISSING signal, not a low one. Net: a real, patch-worthy network DoS on a widely deployed service, but currently theoretical - prioritize behind any confidentiality/integrity or actively-exploited issues. Note also an input inconsistency: the 'Authentication Bypass' tag contradicts the CVSS impact profile (C:N/I:N/A:H) and CWE-841, which describe a DoS, not an auth bypass - treat the tag as erroneous.

A remote, unauthenticated attacker sends a crafted sequence of DNS requests to a reachable Windows DNS server, violating the service's expected behavioral workflow and causing the DNS service to crash or stop responding. Clients and dependent systems relying on that server for name resolution lose service until it recovers or is restarted. No public exploit code is identified at time of analysis, but SSVC flags the technique as automatable.