CVE-2026-62817 – Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-62817 is a critical out-of-bounds write vulnerability in Windows DNS that can allow an unauthorized attacker on an adjacent network to execute code. Exploitation requires low attack complexity, no privileges, and no user interaction. Microsoft assesses exploitation as less likely, and the vulnerability is neither publicly disclosed nor known to be exploited.

CVSS Score: 8.8.

SEVERITY: Critical.

THREAT:
An attacker with adjacent network access could exploit the out-of-bounds write to achieve remote code execution by calling arbitrary endpoints. A successful attack could have a high impact on confidentiality, integrity, and availability.

EXPLOITS:
No known exploitation or public disclosure is reported. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept code is identified.

TECHNICAL SUMMARY:
The vulnerability is caused by an out-of-bounds write in Windows DNS. An unauthorized in-network attacker could exploit the flaw by calling arbitrary endpoints, resulting in remote code execution. The attack vector is Adjacent and attack complexity is Low. No privileges or user interaction are required, and the scope remains unchanged. Successful exploitation can have High confidentiality, integrity, and availability impacts.

EXPLOITABILITY:
Affected software includes Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, and 2025, including listed Server Core installations. Exploitation can occur from an adjacent network without privileges or user interaction.

BUSINESS IMPACT:
Successful exploitation could allow unauthorized remote code execution on affected Windows systems. This creates significant risk to sensitive information, system integrity, and service availability. For organizations operating affected DNS or Windows infrastructure, compromise could disrupt critical services and give an attacker the ability to execute code on vulnerable systems.

WORKAROUND:
No workaround or mitigation is identified. The official fix should be applied to affected systems.

URGENCY:
This vulnerability is rated Critical and can enable remote code execution with low attack complexity, no privileges, and no user interaction. Although exploitation is assessed as Less Likely and no active exploitation is reported, affected systems should be prioritized for deployment of the official fix because successful exploitation can have High confidentiality, integrity, and availability impacts.