CVE-2026-65789

Windows DNS is the “phone book” your network uses to translate names into IP addresses. This bug lets a remote attacker send special network messages to the DNS service, which can make the server crash or allow the attacker to run code as if they had local control. Think of it like someone finding a flaw in the book’s printing process: a bad page can cause the whole system to malfunction or hand control to the attacker.

This matters if your business runs Windows DNS Server on Windows 10 or Windows Server 2016/2019/2022/2025. The vulnerability is triggered remotely by sending crafted network packets, and it does not require authentication or user interaction. It is only a risk if the Windows DNS service is reachable from where an attacker can send network packets (for example, over the internet or any untrusted network path that can reach your DNS server).

This should be treated as urgent (RED) because attackers can potentially reach the DNS service over the network and cause remote code execution without needing a login. Even if you haven’t seen reports of this specific CVE being exploited yet, the flaw directly targets a core network service and has serious outcomes (takeover or outage).

Confirm exposure

• Identify all machines where Windows DNS Server role/service is running.
• For each, note the exact OS version/build.
• Confirm network reachability: from outside your organization (internet), from partner networks, or from any “semi-trusted” segment (misconfigured VPN bridging, guest Wi‑Fi to internal DNS, exposed subnets).

Apply the fix

Update the DNS server hosts to one of the fixed versions below (use the one that matches your OS branch):

• Windows 10 → fixed in 10.0.14393.9418 or 10.0.17763.9121
• Windows Server 2016 → fixed in 10.0.14393.9418
• Windows Server 2019 → fixed in 10.0.17763.9121
• Windows Server 2022 → fixed in 10.0.20348.5499
• Windows Server 2025 → fixed in 10.0.26100.33296

Check after patching

• Ensure the DNS service is running and normal query resolution works.
• Look for stability issues (DNS service crashes/restarts) and review system logs around the time of any unusual DNS traffic.

If patching must be delayed (temporary risk reduction)

• Remove or tightly restrict any untrusted network paths that can reach DNS.
• Limit inbound access to DNS to only required sources (for example, internal resolvers) via firewall rules.
• Monitor for spikes in inbound DNS traffic patterns that could indicate scanning/fuzzing.

KEV / deadline

• This CVE was not found in the CISA KEV list in the provided findings, so no KEV-specific due date applies here.

Severity is high: the impact includes arbitrary code execution and denial of service (system crash) by abusing a Windows DNS memory handling flaw. The mechanism described in the findings is a use-after-free condition in how Windows DNS manages memory, triggered remotely by specially crafted network packets. Authentication is not required, and there is no user interaction; the attacker needs only network reachability to the DNS service. Public exploit code was not found in the provided material, and there is no CISA KEV listing. Press reporting did not provide a dated claim of active exploitation for this CVE; however, actor targeting (“Lazarus group”) was noted via PULSE, and treat that as a reason to prioritize patching. EPSS is reported as a low predicted likelihood with a flat trend, but public prediction data should not reduce urgency given the RED verdict and remote, no-auth trigger described by the findings.