CVE-2026-69730

Windows DNS Server Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 60th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile60th1.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Identify whether your organization is running Windows DNS on any of these systems: Windows 10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025.
For each affected system, check the OS build/revision against the fixed versions listed by Microsoft.
Patch each affected machine using Microsoft’s update for CVE-2026-69730, upgrading to the exact fixed version for your OS branch:
- Windows 10: 10.0.14393.9512 or 10.0.17763.9245
- Windows Server 2012: 6.2.9200.26349
- Windows Server 2012 R2: 6.3.9600.23397
- Windows Server 2016: 10.0.14393.9512
- Windows Server 2019: 10.0.17763.9245
- Windows Server 2022: 10.0.20348.5622
- Windows Server 2025: 10.0.26100.33438
After patching, confirm the DNS service is operating normally and that the system has successfully installed the security update from Microsoft’s update guidance for CVE-2026-69730.
If you cannot patch immediately, reduce exposure by restricting network access to the DNS service (only allow required DNS clients) and monitor DNS-related logs for suspicious activity until patching is completed.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-69730 is a Windows DNS Server bug that can let an attacker run code remotely; if you run DNS on the affected Windows versions, you should patch now.

CVE-2026-69730 is a remote code execution vulnerability in Windows DNS (CWE-416 use-after-free), triggered by crafted network requests to the DNS service that can lead to unauthorized code execution without authentication.

If you're affected

Full server takeover
Widespread network compromise
Service disruption
Data theft risk

What is it

This is a dangerous flaw in Windows DNS, the service that helps translate domain names into network addresses. If someone finds the right way to talk to your DNS server, the bug can let them run malicious code on the server over the network.

Think of DNS like the business’s phone directory: if the directory has a hidden trap, an attacker may be able to take over the person who runs it.

Who is affected

This matters if you run Windows DNS on any of these systems: Windows 10 or Windows Server 2012, 2012 R2, 2016, 2019, 2022, or 2025.

Because the vulnerability is remotely reachable and does not require a login, risk is highest when the DNS service is reachable from untrusted networks (for example, the internet) rather than only from internal, trusted machines.

How urgent is it

This is RED because it is a remote code execution flaw in a core infrastructure service (Windows DNS) with a very high severity score. Even though no public exploit code is listed in the findings, the impact is severe and the patch is available.

Act immediately to close the gap on any affected DNS servers before an attacker targets reachable DNS endpoints.

What to do — in detail

Confirm whether you are exposed
- Determine which of your machines are running the Windows DNS Server role/service.
- Verify the OS version/build/revision for each DNS host.
- Match each DNS host against the fixed versions below to see whether it is already patched.
Target fixed versions per OS branch (patch until you reach these exact revisions)
- Windows 10:
  - fixed in 10.0.14393.9512
  - fixed in 10.0.17763.9245
- Windows Server 2012:
  - fixed in 6.2.9200.26349
- Windows Server 2012 R2:
  - fixed in 6.3.9600.23397
- Windows Server 2016:
  - fixed in 10.0.14393.9512
- Windows Server 2019:
  - fixed in 10.0.17763.9245
- Windows Server 2022:
  - fixed in 10.0.20348.5622
- Windows Server 2025:
  - fixed in 10.0.26100.33438
Apply the update
- Use Microsoft’s update guidance for CVE-2026-69730 (MSRC update guidance).
- Reboot if required by the update process.
- Validate the update is installed successfully.
If patching is delayed (temporary containment)
- Restrict who can reach your DNS service (only allow necessary DNS client IPs).
- Avoid exposing DNS endpoints to the broader internet unless absolutely required.
- Increase monitoring around DNS service activity while you wait for the fix.
What to monitor after patching
- DNS service health and stability.
- Windows event logs for DNS-related errors and unusual spikes in traffic.
- Any indicators of compromise you may already alert on (unusual process creation shortly after DNS activity, unexpected outbound connections, etc.).

Note on timelines: No KEV listing is provided in the findings, and no specific CISA “due date” is given here. Patch availability exists via MSRC guidance for this CVE.

Technical context

Severity/score: CVSS 3.1 score 9.8 (CRITICAL), indicating a remotely exploitable issue with high impact.

Weakness type: CWE-416 (use-after-free). This means the service may reference memory that has been freed, and with the right input an attacker can potentially influence execution.

Attack vector and conditions: The vulnerability is described as remote code execution over a network and is consistent with the provided CVSS characteristics (network-based access, no user interaction, and no privileges required).

Exploitation status: Not listed in KEV, and no public exploit code is on record in the findings. Despite that, the verdict is RED due to the critical impact on a core service and the availability of a patch.

Fix details: Microsoft has fixed the issue in specific OS build/revision versions listed in the findings, with guidance available on MSRC for CVE-2026-69730.

EPSS: A prediction is provided in the findings, but it should not override the practical need to remediate given the RED verdict and patch availability.

Qualys has issued press attention tied to patching for this CVE (PULSE), but no exploitation maturity beyond that is indicated in the provided findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS60th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.0% chance of exploitation activity in the next 30 days, which ranks it in the 60th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 16 days, from the signal feeds we watch.

2026-09-24Patch availablerecord updated
2026-09-23Analysis publishedMicrosoft's Record 972-CVE Patch Tuesday Buried a SigRed Successor. It's Not One of the Confirmed Zero-Days.
2026-09-22Patch availablerecord updated
2026-09-10OpenVAS check addedrecord updated
2026-09-09Record updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

And 13 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable