CVE-2026-62881

Windows DNS Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 26th percentile. A vendor fix is available.

CVSS 3.16.7Medium EPSS percentile26th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-17Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which affected Windows version(s) your organization is running (Windows 10/11 and the listed Windows Server editions).
Identify whether Windows DNS is in use on those machines (for example, any DNS server roles or DNS services running).
Verify the installed Windows update level matches (or exceeds) the fixed versions for your specific branch (see step 4).
Apply the Microsoft update that includes the fix for CVE-2026-62881; upgrade each device to the fixed version for your OS:
- Windows 10: 10.0.14393.9418 or 10.0.17763.9121 or 10.0.19044.7663 or 10.0.19045.7663
- Windows 11: 10.0.22631.7517 or 10.0.26100.9168 or 10.0.26200.9168 or 10.0.28000.2704
- Windows Server 2012: 6.2.9200.26280
- Windows Server 2012 R2: 6.3.9600.23338
- Windows Server 2016: 10.0.14393.9418
- Windows Server 2019: 10.0.17763.9121
If you can’t patch immediately, reduce risk by limiting who has local/authorized access to the affected machines and tightly controlling admin accounts, then patch as soon as the update is available.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-62881 is a Windows DNS flaw where a local attacker who already has the right level of access can gain higher control of the computer; most small businesses only need to worry if an attacker can get local, authorized access first.

CVE-2026-62881 is a local privilege escalation in Windows DNS caused by a numerical precision/truncation error (CWE-197), enabling a high-privileged local account to execute code with higher system control (CWE-122).

If you're affected

Full system takeover after access
Credential theft enabling wider compromise
Service disruption affecting DNS
Lateral movement risk

What is it

Think of Windows DNS like the phonebook your network uses to translate names into IP addresses. This flaw is a mistake in how a number is handled during DNS operations; if a bad actor already has the right kind of access to the machine, they may be able to break out of that access and take full control.

Who is affected

This matters if you run or manage Windows DNS on Windows 10, Windows 11, or the listed Windows Server editions (2012/2012 R2/2016/2019/2022/2025). It’s most relevant when an attacker can already access the machine with authorized permissions (for example, an account compromise or other local access path). Because it’s a local flaw requiring the attacker to have specific permissions, it’s mainly a risk after someone gets local/authorized access—not from normal internet browsing.

How urgent is it

This is RED because reporting indicates it’s being actively targeted in the wild in the context of a new patch, and the attacker capability is “local escalation to higher control,” which can turn an account compromise into full compromise. Even though there are no public details saying this exact CVE is the one used in widely cited articles, the patch attention and actor association mean you should treat this as urgent on any affected DNS systems.

What to do — in detail

Confirm whether you’re potentially exposed:
- Inventory machines running Windows 10/11 or the listed Windows Server editions.
- Determine whether Windows DNS is used on those machines (DNS server role/service). If DNS isn’t present and not used, risk is lower.
Check your current patch level:
- For each affected machine, check the installed Windows build/version.
- Compare it to the fixed versions for your branch (below). If your build is older than the fixed one, you’re exposed.
Upgrade to the fixed versions (target versions):
- Windows 10: fixed in 10.0.14393.9418 OR 10.0.17763.9121 OR 10.0.19044.7663 OR 10.0.19045.7663
- Windows 11: fixed in 10.0.22631.7517 OR 10.0.26100.9168 OR 10.0.26200.9168 OR 10.0.28000.2704
- Windows Server 2012: fixed in 6.2.9200.26280
- Windows Server 2012 R2: fixed in 6.3.9600.23338
- Windows Server 2016: fixed in 10.0.14393.9418
- Windows Server 2019: fixed in 10.0.17763.9121
- (Note: the findings list Windows Server 2022 and 2025 as affected products, but the fixed-version numbers provided here only cover the releases above; use the Microsoft update guide link from the patch card for your exact OS branch.)
Rollout plan (to reduce disruption):
- Patch DNS servers first, because they’re directly relevant to the affected component.
- Then patch remaining servers/workstations where DNS is installed or where Microsoft’s guidance indicates coverage.
If patching must be delayed:
- Lock down local/authorized access: reduce who can log on locally, remove unused admin accounts, and require stronger authentication for privileged access.
- Monitor for signs of account compromise on the affected hosts (unexpected logons, new local admin users, unusual DNS service behavior).
What to monitor after patching:
- Successful installation of the update(s) containing the fix.
- Windows logs around account use and DNS service events for anomalies that may indicate exploitation attempts.

Technical context

CVE-2026-62881 is a Windows DNS local elevation of privilege. The mechanism described in the findings is that an error during numerical handling causes numbers to lose precision, leading to higher control of the system when exploited by a local attacker with specific permissions. This aligns with CWE-197 (numeric truncation/precision issues) and CWE-122 (heap/memory-related or code-execution style impact in the broader classification used by advisories).

Findings summary:

Confirmed exploitation: not confirmed for this exact CVE in the provided news items; however, exploitation is reported for another Windows flaw in the same Patch Tuesday article set, and PULSE notes actor association (Lazarus group) in the context of patching.
KEV: not listed in CISA KEV.
Public exploit code: none reported.
EPSS: provided as a prediction (do not treat as evidence of real exploitation).

Attack vector and reachability:

Local attack with authentication required.
No user interaction is required.
Default reachability is unknown in the findings, and exploitation depends on the attacker having the right level of local/authorized access.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS26th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 26th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 6 days, from the signal feeds we watch.

2026-08-17Patch availablerecord updated
2026-08-16Record updated
2026-08-13OpenVAS check added
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Scored 6.7 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable