Windows DNS Server EUVD-2026-99309

Exploitation targets the Windows DNS Server role specifically - hosts without the DNS Server role installed are not affected. The CVSS vector is PR:N (no authentication) but UI:R, meaning successful exploitation depends on the DNS server being induced to process attacker-supplied data (for example, resolving or caching a maliciously crafted record from attacker-controlled infrastructure) rather than a purely passive network listener being hit; this interaction requirement is the primary limiting factor and should be confirmed with Microsoft. Affected builds span Windows Server 2012 through Server 2025 and Windows 10/11 client editions below the patched build numbers listed in EUVD; patched builds are not exploitable. No special non-default configuration is documented beyond having the DNS Server role active.

This is a genuine high-priority vulnerability, though not an emergency at the time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity, unauthenticated code execution with total CIA impact against the Windows DNS Server role - an attractive, high-value target since DNS servers are typically domain controllers or core infrastructure. Countervailing signals lower the immediate urgency: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (while Technical Impact is 'total'), no CISA KEV listing exists, no public POC is identified, and no EPSS score was provided in the input, so exploitation probability cannot be quantified. One internal conflict should be verified: the CVSS vector sets PR:N (unauthenticated) yet also UI:R (user interaction required), which is unusual for a server-side DNS flaw and suggests exploitation may depend on the server being induced to process attacker-controlled data (e.g., resolving a malicious record) rather than a purely passive listener - confirm the exact trigger with Microsoft. The 'Authentication Bypass' tag is inconsistent with a CWE-843 type-confusion RCE and appears mislabeled. Net: treat as a priority patch for any Windows DNS/AD environment, but current evidence points to no active, automatable exploitation yet.

An attacker induces a vulnerable Windows DNS Server to process a maliciously crafted DNS response or record that triggers a type-confusion condition (CWE-843) in the server's parsing logic, corrupting memory and leading to arbitrary code execution in the DNS service context. Because the CVSS vector requires user/interaction (UI:R), the trigger likely depends on the server performing a resolution against attacker-controlled infrastructure rather than a wholly passive attack. No public exploit code is identified at time of analysis, so this remains a theoretical chain based on the described flaw and CVSS metrics.