Use after free in Windows DNS

CVE-2026-69813 is a use-after-free in the Windows DNS Server service (dns.exe) that allows an unauthenticated remote attacker to send a specially crafted DNS packet and achieve code execution. The catch: exploitation requires winning a race condition (reflected in the CVSS vector's AC:H). Affected systems include every supported Windows Server version running the DNS Server role — Server 2016, 2019, 2022, and 2025 — plus legacy Windows 10 builds 1607 and 1809 that host the role. It was patched in the September 2026 Patch Tuesday alongside eight other DNS Server vulnerabilities.

Microsoft labels this Critical in their advisory but assigns a CVSS base score of only 8.1 — a tension that reflects the race condition difficulty versus the devastating impact. Their own Exploitability Index rates it "Exploitation Less Likely." That assessment is *technically accurate today* — no PoC exists, EPSS is a mere 0.67%, and nobody's seen it in the wild. But the vendor severity actually *undersells* the blast radius: in virtually every Active Directory environment, DNS runs directly on domain controllers. A successful exploit doesn't just pop a DNS server — it delivers SYSTEM on the box that holds your ntds.dit, issues Kerberos tickets, and processes Group Policy. The race condition is the only thing standing between this bug and SigRed-class impact.

Why this verdict

• Role multiplier (decisive): Windows DNS Server runs on domain controllers in >90% of AD environments. Code execution as SYSTEM on a DC means ntds.dit extraction, Golden Ticket forgery, GPO manipulation, and fleet-wide lateral movement. This single factor floors the verdict at CRITICAL regardless of exploitation difficulty.
• Unauthenticated, zero-interaction, network-reachable: The CVSS vector (AV:N/PR:N/UI:N) means any host that can reach port 53 on the DNS server can attempt the exploit. No credentials, no phishing, no user clicking required.
• Race condition is real but not permanent friction: AC:H reflects today's difficulty. History shows DNS UAFs get weaponized — CVE-2020-1350 (SigRed) went from "complex" to reliable PoC within weeks. The complexity tax degrades over time as researchers publish heap analysis.
• Cluster effect: This is one of 9 DNS CVEs in the same patch cycle, including CVE-2026-69730 at CVSS 9.8 with "Exploitation More Likely." Attackers researching one will discover the others. Patching must cover the entire cluster.

Why not higher?

The race condition (AC:H) is genuine exploitation friction today — not every attempt succeeds, and failures crash the DNS service visibly. There is no public PoC, no in-the-wild exploitation, and EPSS reflects near-zero near-term probability. A CVSS 10.0 / unconditional-CRITICAL would require reliable, deterministic exploitation, which this bug does not have today.

Why not lower?

Downgrading to HIGH would require either (a) the affected component to occupy a non-critical role in most deployments, or (b) a compensating control that blocks the attack path entirely. Neither applies: Windows DNS Server is *definitionally* a domain controller component in AD environments, and no WAF or network control can filter malicious DNS without breaking DNS functionality. The blast radius — full domain compromise — is too catastrophic to rate below CRITICAL even with exploitation friction.

1. Restrict DNS Server network exposure to trusted segments only — Use host-based firewall rules (Windows Firewall with Advanced Security) or network ACLs to ensure only authorized clients and forwarders can reach port 53 on your DCs. This reduces the attacker population dramatically. Deploy within 3 days per noisgate mitigation SLA for CRITICAL.
2. Enable enhanced DNS logging and crash monitoring — Configure DNS Analytical logging and monitor for dns.exe crash events (System Event IDs 7031, 7034). Repeated crashes are the telltale sign of race-condition exploitation attempts. Wire alerts to your SOC within 3 days.
3. Deploy Snort/Suricata rules for September 2026 DNS CVEs — Cisco Talos has published Snort signatures covering the September 2026 DNS vulnerability cluster. Deploy on network sensors monitoring DC traffic within 3 days.
4. Patch the entire DNS CVE cluster together — Do not cherry-pick CVE-2026-69813 alone. Patch all 9 DNS Server CVEs from September 2026 in a single maintenance window. The cumulative update covers all of them. Complete remediation within 90 days per noisgate remediation SLA.
5. Consider delegating external DNS to cloud providers — If your Windows DNS servers are internet-facing, migrate external resolution to Azure DNS, Cloudflare, or AWS Route 53. This eliminates the external attack surface for all current and future Windows DNS vulnerabilities. Plan and execute within 90 days.

Run on each Windows Server hosting the DNS Server role. Requires local administrator privileges. Invoke: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-69813.ps1

#Requires -RunAsAdministrator
<#
.SYNOPSIS
  Checks whether the current host is vulnerable to CVE-2026-69813 (Windows DNS Server UAF RCE).
.DESCRIPTION
  1. Verifies DNS Server role is installed.
  2. Checks OS build against known-patched September 2026 cumulative updates.
  Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# Check if DNS Server role is installed
$dnsFeature = Get-WindowsFeature -Name DNS -ErrorAction SilentlyContinue
if (-not $dnsFeature -or $dnsFeature.InstallState -ne 'Installed') {
    Write-Host "[UNKNOWN] DNS Server role is not installed on this host. CVE-2026-69813 does not apply."
    exit 2
}

# Get OS version info
$os = Get-CimInstance Win32_OperatingSystem
$build = [System.Environment]::OSVersion.Version
$hotfixes = Get-HotFix | Sort-Object -Property InstalledOn -Descending

# September 2026 Patch Tuesday: 2026-09-08
# Check if any hotfix from September 2026 or later is installed
$patchDate = [datetime]'2026-09-08'
$septemberPatches = $hotfixes | Where-Object {
    $_.InstalledOn -ge $patchDate
}

# Also check via Windows Update history for cumulative updates
$updateSession = New-Object -ComObject Microsoft.Update.Session
$updateSearcher = $updateSession.CreateUpdateSearcher()
try {
    $historyCount = $updateSearcher.GetTotalHistoryCount()
    $history = $updateSearcher.QueryHistory(0, [Math]::Min($historyCount, 50))
    $recentCU = $history | Where-Object {
        $_.Date -ge $patchDate -and
        $_.Title -match 'Cumulative Update|Security Update' -and
        $_.ResultCode -eq 2  # Succeeded
    }
} catch {
    $recentCU = $null
}

if ($septemberPatches -or $recentCU) {
    $latestPatch = if ($septemberPatches) { $septemberPatches[0].HotFixID } else { $recentCU[0].Title }
    Write-Host "[PATCHED] DNS Server role detected. September 2026 or later update found: $latestPatch"
    Write-Host "  OS: $($os.Caption) Build $($build.Build).$($build.Revision)"
    exit 0
} else {
    Write-Host "[VULNERABLE] DNS Server role is installed but NO September 2026 security update detected."
    Write-Host "  OS: $($os.Caption) Build $($build.Build).$($build.Revision)"
    Write-Host "  Action: Apply September 2026 cumulative update immediately."
    Write-Host "  Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69813"
    exit 1
}

Sources

1. MSRC Advisory — CVE-2026-69813
2. Tenable — September 2026 Patch Tuesday Analysis
3. CrowdStrike — September 2026 Patch Tuesday Analysis
4. Cisco Talos — September 2026 Patch Tuesday Snort Rules
5. everyWAN — The DNS Server You Have to Patch Is Your Domain Controller
6. MSRC API — CVE-2026-69813 Metadata
7. Automox — September 2026 Patch Tuesday CVE Analysis