CVE-2026-69858

CVE-2026-69858 is a use-after-free memory-corruption flaw (CWE-416) in the Windows DNS Server component, addressed by Microsoft in the September 2026 Patch Tuesday release. An unauthorized remote attacker who can send crafted DNS traffic to an affected Windows DNS server can trigger the flaw, in which memory is freed while still in use, potentially corrupting it. Successful exploitation yields arbitrary code execution on the DNS server, though the network-accessible attack carries High attack complexity (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N), indicating reliable exploitation is harder to achieve. Affected are any organizations running the DNS Server role on Windows Server, which is nearly universal on Active Directory domain controllers and common on standalone and internet-facing DNS servers. As of the available data there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns a 0.7% probability of exploitation within 30 days, so no confirmed in-the-wild exploitation is known.

What to do: Apply the September 2026 Microsoft security updates for Windows DNS Server as soon as your release channel provides them, prioritizing domain controllers and any DNS servers reachable from untrusted networks or the internet. Inventory servers with the DNS Server role (e.g., check for the DNS Server feature/role) and verify patch status after deployment. As an interim mitigation, restrict untrusted network access to DNS service ports (TCP/UDP 53) where feasible.