{"id":12002,"date":"2026-09-11T11:48:06","date_gmt":"2026-09-11T17:48:06","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-99-critical-rce-in-windows-dns-server-cve-2026-69730\/"},"modified":"2026-09-29T13:01:20","modified_gmt":"2026-09-29T19:01:20","slug":"alert-2026-99-critical-rce-in-windows-dns-server-cve-2026-69730","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-99-critical-rce-in-windows-dns-server-cve-2026-69730\/","title":{"rendered":"Alert 2026-99 Critical RCE in Windows DNS Server \u2014 CVE\u20112026\u201169730"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n

The vulnerability affects implementations of Windows DNS Server<\/strong> on supported Windows Server systems, including Windows Server 2012 and later versions, as well as certain versions of Windows 10 where the DNS role is running. Windows 11 workstations are not listed in the scope disclosed by the Patch Tuesday analyses.<\/p>\n\n

Component<\/strong><\/td>Affected Product<\/strong><\/td>Risk<\/strong><\/td><\/tr>
Windows DNS Server<\/strong><\/td>Windows Server 2012 and later with the DNS role enabled<\/td>Unauthenticated remote RCE<\/td><\/tr>
Windows DNS Server<\/strong><\/td>Windows 10 versions 1607 and 1809 with the DNS role enabled<\/td>Unauthenticated remote RCE<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

The definitive scope by version, architecture, and applicable KB must be validated through Microsoft’s official guidance for CVE\u20112026\u201169730<\/strong> and the update catalog corresponding to the installed operating system.<\/p>\n\n

Description<\/h2>\n\n

A critical remote code execution (RCE)<\/strong> vulnerability has been disclosed in Windows DNS Server, with a CVSS score of 9.8 labeled as CVE\u20112026\u201169730<\/strong>. An unauthenticated remote attacker can send a specially crafted DNS packet to the affected service and execute code on the system without user interaction; Microsoft estimates that exploitation is more likely<\/strong>.<\/p>\n\n

CVE\u20112026\u201169730<\/strong> is a use-after-free<\/strong> vulnerability in Windows DNS Server. The issue occurs during the processing of DNS packets specifically designed to trigger incorrect memory handling; as a result, an attacker with network connectivity to the DNS service can achieve remote code execution.<\/p>\n\n

The vulnerability is particularly sensitive in Active Directory environments, since it is common for domain controllers to also host the DNS role<\/strong>. In such cases, exploitation could provide code execution on a critical identity asset, significantly elevating the risk of domain compromise, credential theft, policy modification, persistence, and lateral movement.<\/p>\n\n

Solution<\/h2>\n\n

Immediately apply the September 2026 Microsoft security updates<\/strong> on all servers running the Windows DNS Server role. Prioritize domain controllers and DNS servers exposed to or reachable from user networks, VPN, Wi\u2011Fi, branch offices, DMZ, and untrusted segments.<\/p>\n\n

https:\/\/msrc.microsoft.com\/update-guide\/en-US\/advisory\/CVE-2026-69730<\/a><\/p>\n\n

Additional Recommendation:<\/strong><\/p>\n\n

Do not expose Windows DNS Server directly to the Internet<\/strong> unless there is a formal operational need and compensating controls. For public zones, consider separating the public authoritative function from the internal and Active Directory DNS infrastructure.<\/p>\n\n

Additional information:<\/h2>\n\n