Concurrent execution using shared resource with improper synchronization

CVE-2026-62820 is a race-condition flaw (CWE-362) in the Windows DNS Server service that allows an unauthenticated remote attacker to achieve code execution by sending specially crafted packets over the network. No user interaction is required. The vulnerability affects Windows Server 2022 and Windows Server 2025 (both Server Core and full installations) running the DNS Server role, and was disclosed as part of the August 11, 2026 Patch Tuesday release alongside several related DNS Server RCEs (CVE-2026-62878, CVE-2026-62817, CVE-2026-65789). Patches are available via KB5120233 and KB5120228 (hotpatch).

Microsoft rates this HIGH at 8.1 with AC:H to account for the race-condition requirement. That score is technically fair in isolation but dangerously misleading in context. The CVSS vector does not encode *where* the DNS Server role actually runs. In the vast majority of Active Directory environments, Windows DNS is co-located on domain controllers — the single most privileged tier in the enterprise. SYSTEM-level code execution on a DC is not a server compromise; it is a domain compromise. The vendor score treats this as 'one server goes down,' but reality says 'your entire identity plane is owned.' noisgate upgrades to CRITICAL.

Why this verdict

• Role multiplier: Windows DNS Server runs on domain controllers in the vast majority of Active Directory deployments (estimated >70% of installs). Successful RCE grants SYSTEM on a DC → DCSync → domain admin → fleet compromise. This is not a single-server blast radius — it is identity-plane-scale. Per the noisgate role framework, this floors the verdict at CRITICAL.
• Unauthenticated, no-interaction, network-reachable: The CVSS vector is AV:N/PR:N/UI:N, meaning any host that can reach port 53 can attempt exploitation. DNS is one of the most universally exposed services in any network. There is zero attacker prerequisite beyond network access.
• Race condition friction is real but erodible: AC:H reflects that individual attempts are non-deterministic. However, DNS processes thousands of concurrent queries — an attacker can spray crafted packets at high volume to dramatically increase the probability of winning the race. This is not equivalent to the friction of, say, requiring a specific non-default configuration.
• Microsoft's own assessment says 'exploitation more likely': This is Microsoft's signal that the race window is practically winnable, not just theoretically possible. Combined with Talos already shipping Snort detection rules, the security community is treating this as imminently weaponizable.

Why not higher?

This is already assessed at CRITICAL. A score above 8.5 (toward 9.0+) would be warranted if a public PoC existed, if exploitation were observed in the wild, or if the race condition were trivially winnable on first attempt. None of those conditions are met today.

Why not lower?

Downgrading to HIGH would require evidence that fewer than 10% of Windows DNS Server installs occupy the DC role — the opposite is true. The race condition alone is insufficient to break below the CRITICAL floor because DNS is a high-throughput service where spray attacks erode timing-based friction, and Microsoft themselves rate exploitation as 'more likely.' The unauth/no-interaction attack surface eliminates the friction points (phishing, credential theft, VPN access) that justify downgrades in other CVEs.

1. Restrict DNS Server access via Windows Firewall or network segmentation — Limit which hosts and subnets can reach port 53 on your DCs. Most clients only need recursive resolution from their local site DC. Block external inbound DNS to internal DCs entirely. Deploy within 3 days per the noisgate CRITICAL mitigation SLA.
2. Deploy IDS/IPS rules for CVE-2026-62820 — Talos has published Snort rules (SIDs 66902–66948) covering this CVE family. Deploy on inline IPS sensors protecting DNS server segments. This gives you a detection/blocking layer while patching proceeds.
3. Enable dns.exe process monitoring via EDR — Create high-fidelity alerts for any child process spawned by dns.exe on domain controllers. SYSTEM-level code execution from the DNS service will manifest as anomalous process creation. Most EDR platforms can deploy this rule within hours.
4. Separate DNS role from DC role where architecturally feasible — For new deployments or during upcoming maintenance windows, consider running DNS on dedicated member servers rather than DCs. This eliminates the DC blast radius for DNS-targeting exploits. This is a longer-term architectural change.
5. Prioritize patching DCs running DNS first — If you cannot patch all DNS servers within 3 days, triage by role: domain controllers running DNS are the highest-value targets. Patch these first, then standalone DNS servers.

Run this on each Windows Server host that has the DNS Server role installed. Execute as Administrator in an elevated PowerShell session. Example: .\Check-CVE-2026-62820.ps1

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether the host is patched against CVE-2026-62820 (Windows DNS Server RCE).
.DESCRIPTION
    Verifies the DNS Server role is installed, then checks for the August 2026
    cumulative update (KB5120233 or KB5120228) via hotfix history.
    Outputs VULNERABLE, PATCHED, or UNKNOWN.
.NOTES
    Must run as Administrator on the target DNS server.
#>

$ErrorActionPreference = 'Stop'

# Step 1: Check if DNS Server role is installed
try {
    $dnsFeature = Get-WindowsFeature -Name DNS -ErrorAction SilentlyContinue
    if (-not $dnsFeature -or -not $dnsFeature.Installed) {
        Write-Host 'UNKNOWN - DNS Server role is not installed on this host. CVE-2026-62820 does not apply.'
        exit 2
    }
} catch {
    # Fallback for systems without Get-WindowsFeature
    $dnsSvc = Get-Service -Name DNS -ErrorAction SilentlyContinue
    if (-not $dnsSvc) {
        Write-Host 'UNKNOWN - DNS Server service not found. CVE-2026-62820 does not apply.'
        exit 2
    }
}

# Step 2: Check for August 2026 patches
$targetKBs = @('KB5120233', 'KB5120228')
$installedHotfixes = Get-HotFix -ErrorAction SilentlyContinue | Select-Object -ExpandProperty HotFixID

$patched = $false
foreach ($kb in $targetKBs) {
    if ($installedHotfixes -contains $kb) {
        $patched = $true
        Write-Host "PATCHED - $kb is installed. CVE-2026-62820 is remediated."
        exit 0
    }
}

# Step 3: Secondary check - OS build number (Server 2025)
$osBuild = [System.Environment]::OSVersion.Version.Build
$osRevision = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR -ErrorAction SilentlyContinue).UBR

if (-not $patched) {
    # Check if any KB installed after August 11, 2026 (patch date)
    $augustPatches = Get-HotFix -ErrorAction SilentlyContinue | Where-Object {
        $_.InstalledOn -ge [datetime]'2026-08-11'
    }
    if ($augustPatches) {
        Write-Host "UNKNOWN - Post-August-11 hotfix found ($($augustPatches[0].HotFixID)) but not the specific KB for CVE-2026-62820. Verify manually."
        exit 2
    }
}

Write-Host "VULNERABLE - DNS Server role is installed and August 2026 security update is MISSING. CVE-2026-62820 is exploitable."
exit 1

Sources

1. Microsoft MSRC Advisory – CVE-2026-62820
2. CrowdStrike – August 2026 Patch Tuesday Analysis
3. Cisco Talos – August 2026 Patch Tuesday Snort Rules
4. Tenable – August 2026 Patch Tuesday Overview
5. Security Affairs – August 2026 Patch Tuesday: Zero-Day and Wormable RCE
6. Rapid7 – Patch Tuesday August 2026
7. Tenable Nessus Plugin – KB5120233 Windows Server 2025