CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability
CVSS 8.1
IMPORTANT
Critical - Same Day Deployment
“A specially crafted network packet could turn a DNS memory flaw into remote code execution without authentication or user action.”
CVE-2026-72987 is a critical use-after-free vulnerability (CWE-416) in Windows DNS. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires high attack complexity and specific conditions, but successful exploitation could have a high impact on confidentiality, integrity, and availability.
Key Details
- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-416
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.