CVE-2026-77505: Windows DNS Server Remote Code Execution Vulnerability
Published Sep 8, 2026
·Updated
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
Other sources
Windows DNS Server Remote Code Execution Vulnerability
— Microsoft
Affected Software
1 affected component
Microsoft DNS Server
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
CVE Published
via MITRE·05:13 PM
Data Sourced
via MITRE·05:13 PM
DescriptionSeverity
Data Sourced
via NVD·06:20 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker does not need prior authentication or user interaction. Exploitation is performed over the network, although the attack complexity is rated high.
2
Which systems should be prioritized for triage?
Prioritize systems running Windows DNS Server that can receive network traffic from untrusted or broadly reachable sources. The reported impact includes high confidentiality, integrity, and availability impact if exploitation succeeds.