CVE-2026-69730 – Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-69730 is a critical use-after-free vulnerability in Windows DNS that can allow an unauthenticated remote attacker to execute code on an affected system. Exploitation can be performed over the network with low attack complexity by sending a specially crafted packet to an affected service. No privileges or user interaction are required.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability presents a serious remote code execution threat to affected Windows DNS services. An attacker can target the service over the network without authentication, privileges, or user interaction. Successful exploitation could have a high impact on system confidentiality, integrity, and availability.

EXPLOITS: This vulnerability was not publicly disclosed and was not reported as exploited at publication. Exploit code maturity is classified as Unproven, so the source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69730 is caused by a use-after-free memory-management weakness (CWE-416) in Windows DNS. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and trigger the vulnerability. The attack has low complexity, requires no privileges, and needs no user interaction. Successful exploitation can result in remote code execution on the target system, with potentially high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. The vulnerability can be exploited remotely by sending a specially crafted network packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized attacker to execute code on a vulnerable system, creating the potential for serious compromise of affected infrastructure. Because exploitation requires neither authentication nor user interaction and can occur over the network, exposed vulnerable services represent a significant organizational risk. Confidentiality, integrity, and availability can all be affected at a high level.

WORKAROUND: No mitigations or workarounds are listed. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This Critical vulnerability carries a CVSS base score of 9.8 and is assessed as “Exploitation More Likely.” Its network-based, low-complexity attack path requires no privileges and no user interaction. Although exploitation was not reported at publication and exploit maturity is Unproven, affected systems should be prioritized for deployment because successful exploitation can result in remote code execution.