Windows DNS Server EUVD-2026-99864

Exploitation requires an existing authenticated low-privilege local presence on the affected Windows DNS Server host (AV:L, PR:L) - this is NOT remotely exploitable by an anonymous attacker. The flaw lies in the DNS Server's cryptographic signature verification (CWE-347), so a signature-validating configuration (e.g. DNSSEC-related record handling) must be in use for the tampering to have meaning. Limiting factors: the attacker must already be authorized on the system, there is no user-interaction vector to leverage remotely, impact is confined to integrity (no confidentiality or availability loss), and affected hosts must be running a Windows build below the patched versions listed in the EUVD (e.g. Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650).

This is a genuinely moderate, not urgent, issue and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a locally exploitable, low-privilege (PR:L, therefore authenticated) tampering flaw with high integrity impact but no confidentiality or availability impact - matching CWE-347 (improper cryptographic signature verification) and the description's 'authorized attacker ... tampering locally.' CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or public exploitation), Automatable=no, and Technical Impact=partial. EPSS and KEV data were not supplied; absence of a KEV entry combined with SSVC Exploitation=none means there is no evidence of active exploitation ('no public exploit identified at time of analysis'). The one tension worth noting is in the vendor-supplied Tags ('Information Disclosure', 'Jwt Attack'), which conflict with the CVSS impact profile - the vector shows C:N with I:H, i.e. an integrity/tampering flaw, not information disclosure, and nothing in a DNS Server signature-verification defect relates to JWT. Treat those tags as unreliable. Net: a legitimate patch-in-normal-cycle item, prioritized by exposure of the affected DNS servers rather than imminent threat.

An attacker who already holds a low-privileged authenticated foothold on an affected Windows DNS Server host abuses the server's improper verification of a cryptographic signature to forge or alter signed DNS data (e.g. DNSSEC-related records) that the server would otherwise reject. Because the flaw is local (AV:L) with no confidentiality or availability impact, the realistic outcome is tampering with DNS integrity rather than data theft or outage. No public exploit identified at time of analysis, and SSVC lists Exploitation=none.