EUVD-2026-99604
GHSA-m7j9-9j6g-vg2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege network access
-
DeliverySend crafted DNS data to server
-
ExploitTrigger type confusion in DNS Server
-
ExecutionExecute arbitrary code
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Untrusted pointer prevention
|
| Exploitation Conditions | Exploitation requires that the target Windows Server (2022 build <10.0.20348.5761, or 2025 build <10.0.26100.33650) has the DNS Server role enabled and network-reachable, and that the attacker holds valid low-privilege credentials/network authorization (PR:L) - it is NOT an unauthenticated internet-wide attack. The primary limiting factors are the required authentication level and the need for the DNS Server role to be active; no user interaction is required (UI:N) and attack complexity is low (AC:L), so once an authorized attacker can reach the DNS service the barrier is minimal. |
| Impact | This is a genuine high-priority vulnerability, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw in the Windows DNS Server role requiring only low-privilege authentication (PR:L) and no user interaction, yielding full compromise (C:H/I:H/A:H) - consistent with the CWE-822 type-confusion leading to remote code execution. However, the exploitation signals are notably low: there is no CISA KEV listing and no public POC, and CISA's SSVC framework explicitly records Exploitation: none and Automatable: no (while confirming Technical Impact: total). EPSS is not provided in the input, so no probabilistic exploitation estimate is available. The combination of a severe technical impact with 'Exploitation: none / Automatable: no' indicates a serious-but-not-yet-exploited flaw: patch now on normal priority rather than treating it as an actively exploited zero-day. One data inconsistency to note: the input Tag is 'Information Disclosure,' which contradicts the description ('execute code over a network') and the I:H/A:H impacts - the vulnerability is remote code execution, not mere disclosure, so the tag appears mislabeled. |
| Exploit ScenarioDerived | An attacker who already holds low-privilege authenticated access to the network sends crafted DNS protocol data to a Windows Server acting as a DNS server, triggering a type-confusion (CWE-822) condition in the DNS Server's parsing logic. Successful exploitation allows arbitrary code execution in the DNS Server context, leading to full system compromise. No public exploit identified at time of analysis, and CISA SSVC reports no observed exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Type confusion in the DNS Server role on Windows Server 2022 and Windows Server 2025 lets an authenticated, low-privileged attacker who can reach the DNS service over the network execute arbitrary code with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw affects Windows Server 2022 builds below 10.0.20348.5761 and Windows Server 2025 builds below 10.0.26100.33650 (including Server Core installations) where the DNS Server role is enabled and network-reachable. Microsoft has released fixes, and there is no public exploit identified at time of analysis and no CISA KEV listing; CISA's SSVC assessment rates exploitation as none and automation as no, though technical impact is rated total, so this is a genuine high-priority issue rather than an emergency remote unauthenticated attack.
RemediationAI
Vendor-released patch: Microsoft's update guide for CVE-2026-70167 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70167) provides the fix, with the EUVD affected-version ranges indicating patched builds of 10.0.26100.33650 for Windows Server 2025 (including Server Core) and 10.0.20348.5761 for Windows Server 2022; apply the matching cumulative update or later build and reboot so the DNS service reloads. Because exploitation requires the DNS Server role to be reachable and the attacker to hold low-privilege credentials (PR:L), prioritise internet- or DMZ-facing DNS servers, then domain controllers and internal resolvers. Where immediate patching is not possible, compensating controls are: remove the DNS Server role on hosts that do not need it (side effect: loss of name resolution and any AD-integrated DNS functions those hosts provided); restrict network access to TCP/UDP 53 and to the DNS management/RPC interfaces to trusted management or client subnets only (side effect: could break legitimate recursive resolution, zone transfers and remote administration if scoped too tightly, so validate with a staged firewall rule set); and enforce least privilege by reviewing which accounts and services can authenticate to the DNS service, tightening delegation and rotating service credentials, since the flaw is only reachable by an authorized low-privilege principal (side effect: administrative effort and possible disruption to scheduled tasks). There is no public exploit identified at time of analysis and no CISA KEV listing, so these steps are preventive rather than incident-response driven.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-70167 is rooted in CWE-822, Access of Resource Using Incompatible Type, commonly called type confusion. In this case the vulnerable component is the Windows DNS Server role, the service that answers DNS queries on UDP/TCP 53, handles zone data and dynamic updates, and exposes management functionality to administrators. Type confusion arises when the service processes an object or resource record using a structure type that does not match the type it was actually allocated as; the mismatch allows the code to read or write memory through misinterpreted fields, which in a native code service such as the DNS engine can be escalated from a logic error into memory corruption and ultimately arbitrary code execution in the DNS service context. The assessed CVSS vector (network attack vector, low attack complexity, no user interaction, scope unchanged) indicates the attacker can trigger the condition remotely and deterministically once they are authorized to interact with the service, while the PR:L metric shows that valid low-privilege credentials or authorized network access are prerequisites - this is not an unauthenticated internet-wide attack. Note a data-quality discrepancy across sources: the supplied tag set labels this entry as Information Disclosure, whereas the CVSS vector, the EUVD/SSVC data (technical impact: total) and our own assessment all indicate high confidentiality, integrity and availability impact consistent with code execution, so the information-disclosure tag should not be used to downgrade the risk.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable DNS service, low complexity, requires low-privilege authorization (PR:L), no UI; type confusion yields code execution with full confidentiality, integrity, and availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.
Executive ViewAI
Windows Server 2022 and 2025 with the DNS Server role are affected by a high-severity vulnerability that allows an authenticated, low-privileged attacker to execute arbitrary code, potentially compromising the confidentiality, integrity, and availability of critical network services. Although no public exploit identified at time of analysis, the flaw demands urgent attention because DNS is essential for enterprise operations, and exploitation could lead to service outages, data breaches, or further network compromise. Leadership should prioritize patching to protect business continuity and sensitive information.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB