Microsoft Windows DNS: Denial of service due to improper workflow enforcement

Summary

A flaw in the Windows DNS component allows an unauthenticated attacker on the network to cause a denial of service. The vulnerability is classified as CWE-841 (improper enforcement of behavioral workflow). A successful attack impairs name resolution and is limited to availability; confidentiality and integrity are not affected. The attack requires no privileges and no user interaction, so DNS servers reachable from untrusted networks are most at risk.

Affected

• Windows 10 Version 1607: builds below 10.0.14393.9612
• Windows 10 Version 1809: builds below 10.0.17763.9376
• Windows Server 2012 and 2012 R2 (including Server Core): builds below 6.2.9200.26434 and 6.3.9600.23470
• Windows Server 2016: builds below 10.0.14393.9612
• Windows Server 2019: builds below 10.0.17763.9376
• Windows Server 2022: builds below 10.0.20348.5761
• Windows Server 2025: builds below 10.0.26100.33650
• The DNS Server role is the affected component; desktop systems are relevant only if the role is installed.

Fixed in

• Apply the Microsoft security update for CVE-2026-70079 from the Microsoft Update Guide.
• Fixed builds: 10.0.14393.9612 (1607 and 2016), 10.0.17763.9376 (1809 and 2019), 6.2.9200.26434 (2012), 6.3.9600.23470 (2012 R2), 10.0.20348.5761 (2022), 10.0.26100.33650 (2025).
• The full version table on the MSRC page should be checked before rollout.

Workaround

• Restrict access to the DNS service to trusted or allow-listed clients where possible.
• This guidance is secondary; Microsoft's own text was not confirmed. Patching remains the primary fix.

Exploitation

• Not listed in CISA's Known Exploited Vulnerabilities catalog.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• EPSS approximately 0.011.
• No public proof of concept found at the time of research; this does not rule one out.

Our recommendation

• Inventory all hosts running the listed Windows versions and check whether the DNS Server role is installed.
• Patch DNS servers first, using the build numbers from the MSRC page.
• Restrict DNS server access to internal or trusted networks as an interim measure, especially for servers reachable from untrusted networks.
• Check the support status of Windows 10 Version 1607 (LTSB 2016) on Microsoft's lifecycle page and plan an upgrade if support has ended, since the patch may then be unavailable.
• Monitor DNS service availability and logs for unusual traffic.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70079 msrc.microsoft.com
• OpenCVE: CVE-2026-70079 app.opencve.io
• NVD mirror on Vulners: CVE-2026-70079 vulners.com
• CVELIST CNA data on Vulners: CVE-2026-70079 vulners.com
• SonicWall: Microsoft security bulletin coverage for October 2026 www.sonicwall.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:07.