Microsoft Windows DNS Server: Remote Code Execution in DNS Server

Summary

A flaw in the Windows Domain Name Service (DNS) Server role allows an unauthenticated attacker to execute code remotely over the network via an untrusted pointer dereference (CWE-822). Microsoft rates it Important with a CVSS 3.1 base score of 8.8, and user interaction is listed as required. The risk is mainly relevant for DNS servers that are reachable from untrusted networks, such as the internet, DMZ, partner or guest networks.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to < 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to < 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to < 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to < 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9711
• Windows Server 2012 (incl. Server Core): 6.2.9200.0 to < 6.2.9200.26434
• Windows Server 2012 R2 (incl. Server Core): 6.3.9600.0 to < 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to < 10.0.14393.9612

Note: Windows 10 1607 clients are listed in the CVE record, but the DNS Server role normally runs on server editions. Verify on the MSRC page which systems are affected.

Fixed in

Install the October 2026 Windows security update for the affected build. Fixed builds per the CVE record:

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2 and 25H2 and 26H2: 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2012 and 2012 R2: see MSRC page for the corresponding builds

KB numbers: confirm on the MSRC page. Unknown for Windows 10 1607 and Windows Server 2016.

Workaround

Unknown. Microsoft has not published a workaround that we could confirm.

• Third-party suggestion: restrict the DNS Server to trusted networks and limit inbound DNS queries with firewall rules to known IP ranges.
• These are interim measures only and do not remove the flaw.

Exploitation

• Microsoft's exploitability assessment: Unproven (E:U).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
• EPSS about 0.56%.
• No public proof of concept found in our searches; absence is not confirmed.

Our recommendation

• Inventory all hosts running the DNS Server role, including older Windows Server 2012 R2, 2016 and 2019 installations, and check their builds against the fixed versions.
• Patch internet-facing and DMZ DNS servers first with the October 2026 cumulative update.
• Restrict DNS (port 53) to known networks and do not expose it to the internet unless required.
• Monitor for unexpected DNS service crashes or restarts, which may indicate exploitation attempts.
• For internal-only DNS servers, patching within the regular monthly cycle is reasonable.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85903 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-85903 msrc.microsoft.com
• Vulners: NVD record CVE-2026-85903 vulners.com
• Vulners: CISA SSVC data (VulnRichment) CVE-2026-85903 vulners.com
• OpenCVE: CVE-2026-85903 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:17.