CVE-2026-62878

Windows DNS Server Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 60th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile60th1.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-09-02Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run Windows DNS Server (or any Windows host exposing DNS services) on the affected Windows versions: Windows 10, and Windows Server 2012/2012 R2/2016/2019/2022/2025.
For each affected machine, compare your installed patch level to the fixed versions below and determine if you are already patched.
Install the vendor updates from Microsoft Update Guide for CVE-2026-62878.
After patching, restart the affected DNS service (and reboot if required by the update) and confirm the updated version is now in place.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

This is a serious Windows DNS Server security flaw that could let an attacker take full control of the DNS service from across the network—so most businesses using affected Windows Server/Windows 10 versions should act quickly to install the fixed updates.

CVE-2026-62878 is a Windows DNS Server remote code execution vulnerability (CWE-121: stack-based buffer overflow) enabling unauthorized network attackers to execute code, with press attention tied to exploitation by Lazarus group despite no KEV listing or public exploit code on record.

If you're affected

Full DNS service takeover
Malicious code execution on servers
Widespread network disruption
Compromise of internal traffic

What is it

DNS is like your business’s phone book for computer networks: it helps devices find where to go. This flaw lets a remote attacker overwhelm a part of Windows DNS and run their own code, which can lead to the DNS service being controlled or disrupted—making it harder for your internal systems to resolve names reliably.

Who is affected

This matters if you run Windows DNS Server on Windows 10 or Windows Server 2012/2012 R2/2016/2019/2022/2025. Because the weakness is reachable over a network, it’s especially important if your DNS service is reachable by untrusted networks (for example, from the internet or other networks your business doesn’t tightly control).

How urgent is it

Verdict is RED because the vulnerability is tied to exploitation activity referenced in press attention (Lazarus group), meaning attackers are actively using it rather than it being theoretical. Even though there’s no KEV listing and no public exploit code on record, the impact is remote code execution, so you should patch immediately.

What to do — in detail

Confirm exposure

Identify every system that provides DNS service on the affected Windows versions: Windows 10 and Windows Server 2012/2012 R2/2016/2019/2022/2025.
If you’re unsure whether a host is “DNS Server,” check whether it’s running the DNS role/service (your IT admin tools can show this).
Confirm network reachability: determine whether the DNS service is reachable from any untrusted network paths (internet, partner networks, guest Wi‑Fi, VPN segments not restricted to admins, etc.).

Determine whether each machine is already fixed

Compare the installed Windows build/patch level against the fixed versions:
- Windows 10 → fixed in 10.0.14393.9418 (and also fixed in 10.0.17763.9121)
- Windows Server 2012 → fixed in 6.2.9200.26280
- Windows Server 2012 R2 → fixed in 6.3.9600.23338
- Windows Server 2016 → fixed in 10.0.14393.9418
- Windows Server 2019 → fixed in 10.0.17763.9121
- Windows Server 2022 → fixed in 10.0.20348.5499
- Windows Server 2025 → fixed in 10.0.26100.33296

Patch (required remediation)

Install the Microsoft update for CVE-2026-62878 using the Microsoft Update Guide page:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62878
Apply the update for each affected machine, then restart the DNS service and reboot if the update requires it.

If patching is delayed (temporary containment)

Restrict who can reach DNS: block DNS traffic to/from untrusted networks at firewalls where feasible.
Limit DNS exposure to only the networks/clients that truly need it.
Increase monitoring of the DNS server for unusual crashes/restarts or unexpected outbound connections (your IT team can tailor this to your logging setup).

What to monitor after update

DNS server stability (service restarts/crashes).
Error rates in DNS logs.
Any signs of unauthorized changes or unusual network activity from the DNS host.

KEV / due date

This CVE is not listed in the CISA KEV feed per the provided findings, so no specific CISA due date was given here.

Technical context

CVE-2026-62878 affects Windows DNS Server and is classified as a stack-based buffer overflow (CWE-121). The mechanism described is a buffer overflow that can be triggered by a remote attacker over the network, leading to remote code execution. Public exploit code is not on record in the provided findings, and the CISA KEV listing is not present; however, press attention links exploitation activity to Lazarus group, which is treated as a real-world exploitation signal and drives the RED urgency. A patch is available for multiple supported Windows versions with the fixed build numbers listed in the findings. No KEV timing or CISA due date is provided because it is not in KEV.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS60th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.0% chance of exploitation activity in the next 30 days, which ranks it in the 60th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

13 events over 22 days, from the signal feeds we watch.

2026-09-02Patch availablerecord updated
2026-08-17Patch availablerecord updated
2026-08-16Record updated
2026-08-13OpenVAS check added
2026-08-12Record updatedrecord updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 11 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable