Use after free in Windows DNS

CVE-2026-69730 is a use-after-free (CWE-416) in the Windows DNS Server service that allows an unauthenticated, remote attacker to send a specially crafted DNS packet and achieve arbitrary code execution on the target. No user interaction is required. The flaw affects every supported Windows Server version from Server 2012 through Server 2025 (including Server Core installations), plus legacy Windows 10 versions 1607 and 1809 that run the DNS Server role. Microsoft shipped the fix in its September 2026 Patch Tuesday cumulative updates. Crucially, the vulnerability is assessed as wormable — a successful exploit can propagate from one DNS server to the next without human involvement, mirroring the mechanics of the 2020 SigRed bug (CVE-2020-1350).

Microsoft rated this Critical / 9.8 and that rating is accurate — arguably generous in how *calmly* it reads. The CVSS vector is a clean sweep: network-reachable, low complexity, no privileges, no interaction. In the vast majority of Active Directory environments, the DNS Server role runs directly on domain controllers. That means successful exploitation does not merely compromise a DNS service; it delivers SYSTEM-level code execution on a domain controller, which is one privilege-escalation step from full domain compromise. ZDI has called this bug the 'spiritual successor to SigRed,' and given the identical attack surface and wormability profile, that comparison is earned.

Why this verdict

• Unauthenticated remote RCE with zero friction: AV:N/AC:L/PR:N/UI:N means any host with a network path to port 53 can trigger this. DNS is reachable by design from every domain-joined client — the attack surface is the entire internal network.
• Role multiplier — domain controller co-location: In >90% of AD deployments, the DNS Server role runs directly on domain controllers. This is not an edge case; it is the default and recommended Microsoft architecture. Successful exploitation = SYSTEM on a DC = DCSync / Golden Ticket / full domain compromise. The blast radius is domain-scale to forest-scale. This floors the verdict at CRITICAL.
• Wormability multiplies blast radius exponentially: The bug can self-propagate from one DNS server to another without human interaction. In a multi-DC environment (which is every enterprise), a single unpatched DC can seed compromise of the entire DC tier. This is the SigRed pattern, and SigRed drew immediate nation-state and ransomware attention.
• No friction points sufficient to downgrade: There is no authentication barrier, no user interaction requirement, no unusual configuration prerequisite. The only friction is the absence of a public PoC — which is a *temporal* factor that will evaporate, not a structural defense.

Why not higher?

The vendor already assigned the maximum practical score of 9.8 (Scope:Unchanged caps at 10.0 only with Scope:Changed). There is no higher severity bucket than CRITICAL. The score is unchanged at 9.8.

Why not lower?

Downgrading would require structural friction that limits reachability or blast radius. There is none: no auth required, no user interaction, DNS is reachable by design from every internal host, the target component *is* the domain controller in canonical deployments, and the bug is wormable. The absence of active exploitation and a public PoC is a temporal condition that does not reduce the structural severity of the vulnerability. SigRed's PoC appeared within two weeks of patch release; the same timeline is expected here.

1. Disable DNS Server role on non-essential hosts immediately — If you have servers running the DNS role that are not domain controllers or required resolvers, disable the role now. This eliminates the attack surface on those hosts. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL.
2. Deploy Snort/Suricata IDS rules for CVE-2026-69730 — Talos released Snort 2 rules (SIDs 67011–67084) and Snort 3 rules (301619–301655) that detect exploitation attempts. Deploy these on network sensors monitoring DC traffic within 3 days. This provides detection but not prevention unless deployed inline as IPS.
3. Restrict port 53 access to only required clients and forwarders — Use Windows Firewall or micro-segmentation to limit which hosts can reach TCP/UDP 53 on your DCs. In most environments, only domain-joined clients, other DCs, and designated forwarders need access. This narrows the attack surface. Deploy within 3 days.
4. Block external DNS exposure at the perimeter — If any Windows DNS servers are exposed to the internet, immediately firewall inbound port 53 from untrusted sources or move to a non-Windows authoritative DNS solution for external zones. This eliminates the external attack vector.
5. Enable enhanced DNS logging and EDR monitoring on DCs — Ensure Microsoft Defender for Identity (MDI) and your EDR are actively monitoring dns.exe process behavior, unusual child processes, and DCSync/credential extraction attempts on all domain controllers.

Run this on each Windows Server you need to check. Execute in an elevated PowerShell session (Run as Administrator). Example: .\Check-CVE-2026-69730.ps1 — no arguments needed. Requires local admin privileges to query installed hotfixes and service status.

#Requires -RunAsAdministrator
<# CVE-2026-69730 — Windows DNS Server Use-After-Free check #>

$ErrorActionPreference = 'Stop'

# Step 1: Check if DNS Server role is installed
$dnsInstalled = $false
try {
    $dnsFeature = Get-WindowsFeature -Name DNS -ErrorAction SilentlyContinue
    if ($dnsFeature -and $dnsFeature.Installed) { $dnsInstalled = $true }
} catch {
    # Fallback for non-Server SKUs
    $dnsSvc = Get-Service -Name DNS -ErrorAction SilentlyContinue
    if ($dnsSvc) { $dnsInstalled = $true }
}

if (-not $dnsInstalled) {
    Write-Host '[UNKNOWN] DNS Server role is not installed on this host. Not directly vulnerable to CVE-2026-69730.' -ForegroundColor Yellow
    exit 2
}

Write-Host '[INFO] DNS Server role IS installed. Checking patch status...' -ForegroundColor Cyan

# Step 2: Check OS build and September 2026 cumulative update
$os = Get-CimInstance Win32_OperatingSystem
$build = [System.Environment]::OSVersion.Version
Write-Host "[INFO] OS: $($os.Caption) | Build: $($build.ToString())" -ForegroundColor Cyan

# Check for September 2026 updates (installed on or after 2026-09-08)
$septemberPatches = Get-HotFix | Where-Object {
    $_.InstalledOn -ge [datetime]'2026-09-08'
} | Sort-Object InstalledOn -Descending

if ($septemberPatches.Count -gt 0) {
    $latest = $septemberPatches[0]
    Write-Host "[PATCHED] Found post-September-2026 update: $($latest.HotFixID) installed on $($latest.InstalledOn.ToString('yyyy-MM-dd'))" -ForegroundColor Green
    Write-Host 'CVE-2026-69730: PATCHED' -ForegroundColor Green
    exit 0
} else {
    Write-Host '[VULNERABLE] DNS Server role is installed but no September 2026 (or later) cumulative update detected.' -ForegroundColor Red
    Write-Host 'CVE-2026-69730: VULNERABLE' -ForegroundColor Red
    Write-Host 'ACTION: Apply the September 2026 cumulative security update immediately.' -ForegroundColor Red
    exit 1
}

Sources

1. Help Net Security — September 2026 Patch Tuesday: SigRed Successor
2. CrowdStrike — Patch Tuesday September 2026 Analysis
3. Talos Intelligence — Microsoft Patch Tuesday September 2026 Snort Rules
4. Tenable — September 2026 Patch Tuesday CVE Analysis
5. The Hacker News — Microsoft Patches Record 974 Flaws
6. SecurityAffairs — 974 CVEs, 2 Zero-Days, 20 Wormable Bugs
7. Automox — Patch Tuesday September 2026 CVE Analysis