CVE-2026-62878

Windows DNS contains a stack-based buffer overflow (CWE-121) that an unauthenticated, network-adjacent or internet-reachable attacker can trigger by sending crafted input to the DNS service. Successful exploitation yields remote code execution on the target host, with high impact on confidentiality, integrity and availability (CVSS 3.1: 9.8). The flaw affects the DNS component shipped with Windows 10 1607 and 1809 and with Windows Server 2012, 2016, 2019, 2022 and 2025; systems running the DNS Server role, especially internet-facing DNS servers and domain controllers, are the primary targets. Microsoft, which assigned the CVE, has issued a fix, and the flaw appeared amid a record-sized run of Patch Tuesday releases. No in-the-wild exploitation is currently known: it is not in CISA's KEV, no public proof-of-concept is available, and EPSS estimates only a 1.3% probability of exploitation within 30 days.

What to do: Apply Microsoft's security update addressing CVE-2026-62878 on all affected Windows 10 (1607, 1809) and Windows Server (2012-2025) hosts, prioritizing internet-facing DNS servers and domain controllers. Until patched, restrict exposure of TCP/UDP 53 to trusted clients and forwarders and avoid publishing Windows DNS directly to the internet. Verify which hosts expose port 53 at the perimeter and monitor for anomalous DNS request patterns as a stopgap detection.