Windows DNS Server: Spoofing vulnerability

Summary

Windows DNS, the DNS server role on Windows Server, contains a spoofing vulnerability (CVE-2026-119905) in the affected builds of Windows Server 2016, 2019, 2022 and 2025. According to the CVE record, an attacker with network access and high privileges can perform spoofing. The official CVE record describes the issue as improper input validation, but the assigned CWE-22 (path traversal) does not match that description, so the classification may change after NVD analysis.

Affected

• Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows Server 2022: builds before 10.0.20348.5870
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33822
• Windows client versions: Unknown.

Fixed in

• Install the Microsoft November 2026 cumulative update for each affected Windows Server version.
• First fixed builds: 10.0.14393.9688 (2016), 10.0.17763.9487 (2019), 10.0.20348.5870 (2022), 10.0.26100.33822 (2025).

Workaround

Unknown. No vendor-published workaround was found for this CVE.

Exploitation

• CISA SSVC: exploitation none, not automatable, technical impact partial.
• Not known to be exploited in the wild; no CISA KEV listing found.
• A public proof of concept may exist according to a third-party monitor. This is unverified.

Our recommendation

• Patch Windows Server DNS servers and domain controllers with the November 2026 cumulative update, starting with DNS hosts reachable from untrusted networks.
• Check which servers run the DNS role, including domain controllers with AD-integrated DNS.
• Restrict who can reach DNS services and limit administrative access, since the attack requires high privileges.
• Monitor DNS server logs for unusual activity until patching is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  overgrowncarrot1/CVE-2026-119905-DNS-Log-Poisoning-UNC-Path

Research sources

• Microsoft Security Update Guide: CVE-2026-119905 msrc.microsoft.com
• CVE Record CVE-2026-119905 www.cve.org
• Strix AI: CVE-2026-119905 www.strix.ai
• Rapid7: November 2026 Patch Tuesday www.rapid7.com
• Security Affairs: November 2026 Patch Tuesday securityaffairs.com
• SOCRadar: November 2026 Patch Tuesday socradar.io
• Exploitable CVEs Monitor issue 19 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:38.