CVE-2026-62820 – Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-62820 is a critical remote code execution vulnerability caused by improper synchronization of a shared resource in Windows DNS. An unauthenticated remote attacker could send a specially crafted packet to an affected service and attempt to win a race condition. Successful exploitation could allow attacker-controlled code to execute on the target system.

CVSS Score: 8.1.

SEVERITY: Critical.

THREAT:
An attacker can target the vulnerable service remotely over the network without privileges or user interaction. Although exploitation requires winning a race condition and therefore has high attack complexity, successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is a race condition (CWE-362) involving concurrent execution using a shared resource without proper synchronization in Windows DNS. An unauthenticated attacker could send a specially crafted packet to an affected service over the network. Exploitation requires the attacker to successfully win the race condition, which accounts for the High attack complexity rating. If successful, the attacker could execute code on the target system. The CVSS metrics identify Network attack vector, no privileges required, no user interaction required, unchanged scope, and High confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected products are Windows 10 Version 1607 (32-bit and x64), Windows 10 Version 1809 (32-bit and x64), Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation can occur remotely by sending a specially crafted packet to an affected service and successfully triggering the race condition.

BUSINESS IMPACT:
Successful exploitation could allow unauthorized remote code execution and result in significant compromise of confidentiality, integrity, and availability. For organizations operating affected Windows systems, compromise could disrupt services, expose sensitive information, or enable unauthorized changes on the targeted system.

WORKAROUND:
No workaround or mitigation is identified. An official fix is available for the listed affected software.

URGENCY:
This vulnerability is rated Critical and can enable remote code execution without authentication or user interaction. Although exploitation is assessed as Less Likely and requires winning a race condition, the potential impact is high across confidentiality, integrity, and availability. The official fix should therefore be prioritized for affected systems.