CVE-2026-69858 – Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-69858 is a critical use-after-free vulnerability in Windows DNS Server. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and, if exploitation succeeds, execute code on the target system. Exploitation requires winning a race condition, making attack complexity high. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: The vulnerability can be attacked remotely over the network and requires no privileges or user interaction. Successful exploitation could have a high impact on confidentiality, integrity, and availability. Attack complexity is high because successful exploitation requires the attacker to win a race condition.

EXPLOITS: The exploitability assessment is Exploitation Unlikely, with exploit code maturity listed as Unproven. The vulnerability is not publicly disclosed and is not known to be exploited. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69858 is a CWE-416 use-after-free vulnerability in Windows DNS Server. An unauthenticated attacker could send a specially crafted packet to an affected DNS service over the network. Successful exploitation requires winning a race condition and could result in remote code execution on the target system. No authentication or user interaction is required, and successful exploitation could significantly affect confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products are Windows Server 2022, Windows Server 2022 Server Core installation, Windows Server 2025, and Windows Server 2025 Server Core installation. Exploitation can be attempted remotely with a specially crafted network packet, but attack complexity is high.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on an affected Windows DNS Server, creating risks to sensitive information, system integrity, and service availability. For organizations relying on affected DNS servers, compromise could disrupt critical infrastructure and expose server resources to attacker-controlled code.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed as the remediation, and installation requires a restart.

URGENCY: This vulnerability is rated Critical and can permit unauthenticated remote code execution without user interaction. Although exploitation is assessed as unlikely and no exploitation is reported, the potential impact is high across confidentiality, integrity, and availability. The official fix should therefore be prioritized for affected Windows Server systems.