Windows Server DNS: Denial of service via uncaught exception

Summary

A flaw in the DNS server component of Windows Server allows an unauthenticated attacker on the network to crash the DNS service. The service stays down until the server is rebooted or patched, which can disrupt name resolution and, on domain controllers, Active Directory logons. Microsoft rates the impact as availability only (CVSS 3.1: 7.5, network, no privileges, no user interaction).

Affected

• Windows Server 2012 and Server Core installation: 6.2.9200.0 to below 6.2.9200.26434
• Windows Server 2012 R2 and Server Core installation: 6.3.9600.0 to below 6.3.9600.23470
• Windows Server 2016 and Server Core installation: 10.0.14393.0 to below 10.0.14393.9612
• Windows Server 2019 and Server Core installation: 10.0.17763.0 to below 10.0.17763.9376
• Windows Server 2022: 10.0.20348.0 to below 10.0.20348.5761
• Windows Server 2025 and Server Core installation: 10.0.26100.0 to below 10.0.26100.33650

Fixed in

• Fixed builds according to the CNA record: Server 2012 6.2.9200.26434, Server 2012 R2 6.3.9600.23470, Server 2016 10.0.14393.9612, Server 2019 10.0.17763.9376, Server 2022 10.0.20348.5761, Server 2025 10.0.26100.33650
• Verify these builds against the Microsoft Security Update Guide before rollout. KB number for Server 2012 and 2012 R2: Unknown.

Workaround

Unknown. No vendor workaround has been identified.

• Until patched, limit which networks can reach the DNS service on affected servers.
• Restrict recursion to internal clients. These are general measures, not vendor-documented ones.

Exploitation

• Microsoft marks the vulnerability as not publicly disclosed and not exploited; exploit maturity is Unproven.
• No public proof of concept or in-the-wild exploitation was found.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• EPSS score about 0.012. CISA KEV and public PoC sources were not checked.

Our recommendation

• Identify all Windows Server systems with the DNS role, especially Server 2012 and 2012 R2 and any DNS reachable from the internet.
• Install the Microsoft security update via Windows Update or WSUS and confirm the build number afterwards.
• Where no patch is available, Windows Server 2012 and 2012 R2 are end-of-life: plan an upgrade and check whether Extended Security Updates apply.
• Until patched, restrict DNS access to required networks and monitor DNS service availability.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-70082 msrc.microsoft.com
• MSRC product list (en-US) msrc.microsoft.com
• CNA affected versions (Vulners mirror) vulners.com
• Product list incl. 2016-2025 (Vulners MSCVE) vulners.com
• NVD record (Vulners, incl. EPSS) vulners.com
• Build numbers and CVSS (StrixAI) www.strix.ai
• Impact and mitigation summary (OpenCVE) app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:08.