The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check whether any device in your business runs the Windows DNS Server role (it can be a domain controller or a dedicated DNS server).
Verify your Windows version/build and current patch level against the fixed versions listed below.
Upgrade/patch Windows to the fixed version for your exact OS (listed in the next section) and reboot if required.
If you cannot patch immediately, restrict network access to the DNS server (limit who can reach it) and monitor for unusual DNS-related traffic and crashes.
Out-of-bounds write in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.
In plain language
Written by AI from the record
This is a serious flaw in Windows DNS Server that could let an attacker remotely run code if they can reach your DNS service; most small businesses should act quickly to patch if you run Windows DNS.
CVE-2026-62817 is a Windows DNS Server remote code execution vulnerability caused by an out-of-bounds write (CWE-787), where a remote attacker can trigger memory corruption over an adjacent network connection.
If you're affected
Full server takeover
Widespread network compromise
Service outage and downtime
Credential theft and persistence
What is it
Think of your DNS server as the phone book for your network: it helps machines find the right addresses. This vulnerability is like a bug that can let a remote attacker force the DNS server to run attacker-controlled instructions—turning your “phone book” into a doorway to the server.
Who is affected
This matters if you run Windows DNS Server on Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025. Because it’s remote (network-triggered), it’s especially important to patch systems that are reachable from other machines or networks. The risk is highest when an attacker can reach the DNS service over the network and your system isn’t updated to the fixed versions.
How urgent is it
Mark this as urgent because it is a remote code execution vulnerability in a core network service (Windows DNS), meaning a network-connected attacker could gain control. Even though no public exploit code is on record and it’s not listed in CISA KEV, the vulnerability has received security attention alongside a patch (and is associated in reporting with Lazarus group), so you should patch without waiting.
What to do — in detail
Inventory where Windows DNS is running
Identify every machine running the Windows DNS Server role (including domain controllers, if they provide DNS).
Determine whether a system is affected
For each DNS server, check the Windows version/build and compare it to the fixed versions below.
If the build is older than the fixed version for your OS release, treat it as vulnerable until patched.
Apply the correct fixed update (per OS)
Windows 10: fixed in 10.0.17763.9121; 10.0.19044.7663; 10.0.19045.7663
Windows 11: fixed in 10.0.22631.7517; 10.0.26100.9168; 10.0.26200.9168; 10.0.28000.2704
Windows Server 2019: fixed in 10.0.17763.9121
Windows Server 2022: fixed in 10.0.20348.5499
Windows Server 2025: fixed in 10.0.26100.33296
Reboot if your update process requires it (follow your normal Windows update policy).
Temporary workaround if patching is delayed
Restrict who can reach your DNS server: allow DNS traffic only from required internal systems and known management networks.
If possible in your environment, move DNS queries to a patched DNS server and limit direct access to the vulnerable one.
Validate after patching
Confirm the DNS servers now show the expected fixed build numbers.
Watch for service stability: DNS crashes/restarts, unusual spikes in DNS traffic, or abnormal error rates.
What to monitor over the next days
Unexpected inbound connections to DNS-related ports from unusual sources.
Event logs for DNS service failures, memory errors, or repeated crashes.
Any signs of persistence or privilege escalation (only if you have a reason to suspect an active compromise).
Technical context
CVE-2026-62817 is assessed as HIGH (CVSS 8.8) and categorized under CWE-787 (out-of-bounds write). The weakness is an out-of-bounds memory write in Windows DNS, which can be triggered by a remote attacker over network adjacency and can lead to remote code execution.
Exploitation status: no KEV entry (not listed in CISA KEV) and no public exploit code is on record; however, the overall traffic-light verdict is RED. Patch status is known with multiple fixed build versions across Windows 10/11 and Windows Server 2019/2022/2025.
EPSS is predicted (0.6%, flat trend), but public owner guidance here should be driven primarily by the confirmed availability of patches and the RED priority rather than EPSS alone.
KEV meaning: because it is not in KEV, there is not (in the provided findings) an official CISA-confirmed exploitation indicator; still, due to the remote code execution nature of the flaw in a network-facing component, patching is critical.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
