Windows DNS Server EUVD-2026-99154

Exploitation requires the attacker to already have local, authenticated access with low privileges (AV:L/PR:L) on a Windows Server where the DNS Server role is installed and running; it cannot be triggered remotely or by an unauthenticated actor. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the local-access and existing-foothold prerequisite is the primary limiting factor. The flaw is an incorrect authorization check (CWE-863) that bypasses an unspecified DNS security feature; because Microsoft's description does not name the exact feature, configuration mode, or whether non-default settings are involved, the precise triggering condition should be confirmed via the MSRC advisory. Impact is limited to integrity - no confidentiality or availability loss.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 score of 5.5 (Medium) is driven entirely by an integrity impact (I:H) with no confidentiality or availability loss (C:N/A:N), and crucially requires local access with low privileges (AV:L/PR:L), which sharply limits the attack surface compared to a remotely exploitable DNS flaw. All exploitation signals point low: CISA's SSVC decision framework records Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale), and Technical Impact=partial, which aligns with the limited integrity-only CVSS impact. There is no CISA KEV listing and no public proof-of-concept identified at time of analysis, and no EPSS score was provided in the input to independently gauge exploitation probability. The signals are internally consistent rather than conflicting - a local, authenticated, non-automatable security-feature bypass with partial impact - so this reads as a real but low-urgency hardening fix rather than a high-CVSS-but-illusory risk or an actively-targeted threat. The one caveat: the description is a terse Microsoft-style summary ('bypass a security feature locally') and does not name the specific DNS security feature circumvented, so the precise real-world consequence of the integrity bypass should be confirmed against Microsoft's MSRC advisory.

An attacker who already has a low-privileged foothold on a Windows Server running the DNS Server role abuses the incorrect authorization check to bypass a DNS security feature they should not be able to affect, allowing them to tamper with DNS configuration or records (integrity impact) without the normally required permissions. No public exploit code has been identified at time of analysis, and the local access and low-complexity-but-authenticated prerequisites mean this would be used for post-compromise escalation or lateral abuse rather than initial access.