Microsoft Windows DNS Server: Remote code execution vulnerability

Summary

An untrusted pointer dereference in the Windows DNS Server role allows an unauthenticated attacker to execute code remotely over the network. Microsoft rates the impact on confidentiality, integrity and availability as high, and CISA's SSVC data rates it as total technical impact. User interaction is flagged (UI:R), so the exact trigger should be confirmed with Microsoft. Exposure is mainly relevant where a Windows DNS Server is reachable from untrusted networks or the internet.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807 (one aggregator shows an inconsistent range, verify with MSRC)
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2: builds before 10.0.26100.9711
• Windows 11 Version 25H2: builds before 10.0.26200.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows 11 Version 26H2: builds before 10.0.26300.9711
• Windows Server 2022: builds before 10.0.20348.5761
• Windows Server 2025: the research notes cite 10.0.26100.33650, which conflicts with the CNA range, verify with MSRC

Fixed in

• Install the October 2026 cumulative update for your Windows version (fixed builds as listed above).
• Windows Server 2019 / Windows 10 1809: KB5126651 according to Tenable.
• Windows Server 2025: KB5126646 according to Tenable.
• Windows 10 1607 / Windows Server 2016: KB number unknown, obtain it from the MSRC Security Update Guide.

Workaround

• No official vendor workaround is confirmed.
• Run the DNS Server service under a least-privilege account and restrict its permissions (general hardening, does not replace patching).
• Do not expose DNS Server roles to untrusted networks; restrict access with firewall rules.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• Not listed in the CISA KEV catalog (as of the OpenCVE snapshot).
• No public proof of concept found in the research; re-check before final risk acceptance.

Our recommendation

• Identify all Windows DNS Server roles, especially any on edge, DMZ or internet-facing segments, and prioritise them.
• Apply the October 2026 security update to all affected systems, verifying the KB and build number in the MSRC Security Update Guide.
• Restrict DNS Server access to required networks only using firewall rules.
• Monitor DNS Server logs and endpoints for unusual activity until patched.
• Confirm NVD status and MSRC details, as sources differ.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88114 msrc.microsoft.com
• OpenCVE: CVE-2026-88114 app.opencve.io
• Vulners CVELIST: CVE-2026-88114 vulners.com
• Vulners VULNRICHMENT: CVE-2026-88114 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:13.