Windows DNS Server EUVD-2026-99152

Exploitation requires the attacker to already hold low-privileged authenticated access on a system running the Windows Server DNS Server role (AV:L, PR:L), and to invoke the specific DNS operation whose authorization check is missing; no user interaction is needed (UI:N). Limiting factors that reduce real-world risk: the attacker must first obtain local access and valid credentials on the DNS server, the impact is confined to integrity/tampering (C:N, A:N - no data disclosure or denial of service), and the scope is unchanged (S:U). The exact DNS feature, record type, or administrative operation lacking the check is not detailed in the available data and should be confirmed against the MSRC advisory.

This is a genuinely moderate, not urgent, issue and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a locally-exploitable flaw requiring low-level authenticated privileges that yields high integrity impact but no confidentiality or availability loss - matching the description of an 'authorized attacker' performing 'tampering locally.' CISA SSVC reinforces low urgency: Exploitation=none (no observed activity), Automatable=no (local access and prior privileges prevent mass scripting), and Technical Impact=partial. There is no CISA KEV listing and no EPSS score was provided in the input, so there is no quantitative exploitation-probability signal to weigh; the absence of EPSS is a data gap, not evidence of low risk per se. No public exploit code was identified at time of analysis. All signals point the same direction - a legitimate but low-priority, locally-scoped integrity flaw on DNS servers rather than a high-CVSS-but-overstated issue or a remotely-wormable threat. The one metadata tension worth noting: the 'Authentication Bypass' tag conflicts with the actual weakness class (CWE-862 Missing Authorization) and the description ('missing authorization'), which describe an authorization failure by an already-authenticated principal, not an authentication bypass - treat the tag with caution.

An attacker who already has a low-privileged authenticated foothold on a Windows DNS Server (e.g. an unprivileged local/interactive account or a low-tier service account) leverages the missing authorization check to tamper with DNS data or configuration that should be gated behind higher privileges. Because exploitation requires local access plus existing credentials and only affects integrity, it is most plausible as a post-compromise privilege/trust-escalation step rather than an initial-access vector. No public exploit code was identified at time of analysis.