Windows DNS Server EUVD-2026-99153

Requires the Windows DNS Server role to be installed and running, and the attacker must already possess a local, low-privileged account or interactive/logon session on that DNS server host (AV:L, PR:L). Exploitation is LIMITED by these prerequisites: it is not remotely reachable over the network, cannot be performed by a fully unauthenticated actor, and needs no victim user interaction. Impact is confined to integrity (tampering with DNS data/configuration); there is no confidentiality disclosure or denial of service per the CVSS vector. Affected builds span Windows Server 2012 through 2025 (including Server Core installations) and Windows 10 1607/1809 below the patched build numbers listed by the vendor.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5 Medium) tells a consistent story: exploitation requires LOCAL access and at least low-level existing privileges (PR:L) on the DNS Server host, with no user interaction, and yields a HIGH integrity impact but NO confidentiality or availability impact - matching the description's 'authorized attacker performing tampering locally.' All signals align downward: CISA SSVC rates Exploitation as 'none' (no observed or public exploitation), Automatable as 'no' (cannot be reliably scripted at scale, consistent with the local/authenticated vector), and Technical Impact as 'partial' (not total system control). There is no CISA KEV listing and no POC referenced in the data, so there is no public exploit identified at time of analysis. No EPSS score was provided, so exploitation probability cannot be quantified from the input. The practical risk is an authenticated local user tampering with DNS configuration/records (integrity) rather than remote mass exploitation - treat it as a standard patch-cycle item, prioritized where untrusted users have local/low-privilege access to DNS servers. The CVSS vector, description (both local/authorized), and SSVC are mutually consistent; no contradictory signals were found in the provided data.

An attacker who already holds a low-privileged local account or session on a Windows Server running the DNS Server role abuses an incorrect-authorization flaw (CWE-863) to tamper with DNS data or configuration they should not be able to modify. No remote access, user interaction, or administrative rights are required beyond the initial low-privilege foothold. No public proof-of-concept or active exploitation is referenced in the available data.