CVE-2026-65789

CVE-2026-65789 is a use-after-free memory-safety flaw (CWE-416) in the Windows DNS component, rated CVSS 8.1 High. An unauthenticated remote attacker can trigger it over the network by sending traffic to a system running the affected DNS service; the high attack complexity (AC:H) means exploitation depends on specific conditions rather than a simple request. Successful exploitation yields remote code execution in the DNS service context, with high confidentiality, integrity, and availability impact on the host. Affected systems are Windows 10 1607 and 1809 (the long-term servicing branches) and Windows Server 2016, 2019, 2022, and 2025. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at 0.5% (44th percentile); the fix appears to have shipped amid Microsoft's record September 2026 Patch Tuesday, which resolved 974 CVEs.

What to do: Apply Microsoft's current security update for the affected releases (the September 2026 Patch Tuesday batch) to Windows 10 1607/1809 and Windows Server 2016/2019/2022/2025, prioritizing domain controllers and any host with the DNS Server role exposed to untrusted networks. Inventory systems running the DNS Server service and, where patching is delayed, restrict inbound TCP/UDP 53 to trusted resolvers. No public PoC or KEV listing exists yet, so near-term mass exploitation risk is low, but patching should follow standard Patch Tuesday timelines.