Windows DNS Server: Remote code execution due to type confusion
Summary
A type confusion weakness in the Windows DNS Server role allows an authorized attacker to execute code remotely over the network. Microsoft lists the impact as Remote Code Execution with an Important severity and a CVSS base score of 8.8. The sources do not describe the exact access level required beyond authorization, so an attacker with any valid foothold in the network should be considered possible.
Affected
- Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
- Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650
Fixed in
- Windows Server 2022: build 10.0.20348.5761 or later (October 2026 cumulative update, KB5126655 according to a third-party mirror, not verified on Microsoft's site)
- Windows Server 2025: build 10.0.26100.33650 or later (KB5126646 according to a third-party mirror, not verified)
Workaround
Unknown. No vendor-documented workaround was found. Until patched, restrict which hosts can reach the DNS service.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC data in the CVE record: exploitation none, not automatable.
- Microsoft exploit maturity: Unproven (E:U).
- No public proof of concept found.
- A Tenable plugin page shows an exploit-available flag and a CISA KEV due date for this update, but the page appears to mix up CVEs. KEV status is unverified.
Our recommendation
- Install the October 2026 security update on all Windows Server 2022 and 2025 DNS servers in the next maintenance window.
- Confirm the fixed Server 2022 build on the MSRC page before rollout.
- Prioritise DNS servers reachable from untrusted networks and all domain controllers.
- Limit access to the DNS service and keep it off the internet where it is not needed.
- Check the CISA KEV catalog for this CVE and monitor for exploitation.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70167 msrc.microsoft.com
- OpenCVE: CVE-2026-70167 app.opencve.io
- Vulners (NVD mirror): CVE-2026-70167 vulners.com
- Strix: CVE-2026-70167 www.strix.ai
- Vulners (CISA Vulnrichment mirror): CVE-2026-70167 vulners.com
- Tenable plugin 365470 (conflicting signal) www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:55.
Original description (NVD)
Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.