CVE-2026-65789 – Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-65789 is a critical use-after-free vulnerability (CWE-416) in Windows DNS that can allow an unauthenticated attacker to execute code remotely. Exploitation requires specific network configurations and timing conditions, making attacks more difficult and less reliable. The vulnerability is not publicly disclosed or known to be exploited.

CVSS Score: 8.1.

SEVERITY: Critical.

THREAT:
An attacker with network access to an affected DNS service could send a specially crafted packet and potentially achieve remote code execution. No privileges or user interaction are required, although successful exploitation depends on specific conditions and has only been observed in limited scenarios.

EXPLOITS:
No exploitation has been reported, and the vulnerability is not publicly disclosed. Exploit code maturity is classified as Unproven, and exploitation is assessed as unlikely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free memory condition in Windows DNS. An unauthenticated attacker can send a specially crafted packet to an affected service over the network. If the required network configuration and timing conditions are met, successful exploitation can allow code execution on the target system. The CVSS metrics indicate network-based attack access, high attack complexity, no privileges required, no user interaction, unchanged scope, and high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809 for 32-bit and x64 systems, Windows Server 2016, 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires a specially crafted network packet and specific configuration and timing conditions.

BUSINESS IMPACT:
Successful exploitation could give an unauthenticated attacker the ability to execute code on an affected system, potentially causing serious confidentiality, integrity, and availability impacts. For organizations operating affected DNS services, compromise of infrastructure providing a core network function could create significant operational and security risk.

WORKAROUND:
No workaround or mitigation is listed. An official fix is identified as the remediation.

URGENCY:
This vulnerability is rated Critical and can result in remote code execution without authentication or user interaction. Although exploitation is assessed as unlikely and requires favorable conditions, the potential impact is high across confidentiality, integrity, and availability. Organizations running the affected Windows versions should prioritize deployment of the official fix.