CVE-2026-62817

Think of your DNS server as the phone book for your network: it helps machines find the right addresses. This vulnerability is like a bug that can let a remote attacker force the DNS server to run attacker-controlled instructions—turning your “phone book” into a doorway to the server.

This matters if you run Windows DNS Server on Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025. Because it’s remote (network-triggered), it’s especially important to patch systems that are reachable from other machines or networks. The risk is highest when an attacker can reach the DNS service over the network and your system isn’t updated to the fixed versions.

Mark this as urgent because it is a remote code execution vulnerability in a core network service (Windows DNS), meaning a network-connected attacker could gain control. Even though no public exploit code is on record and it’s not listed in CISA KEV, the vulnerability has received security attention alongside a patch (and is associated in reporting with Lazarus group), so you should patch without waiting.

1. Inventory where Windows DNS is running

   • Identify every machine running the Windows DNS Server role (including domain controllers, if they provide DNS).

2. Determine whether a system is affected

   • For each DNS server, check the Windows version/build and compare it to the fixed versions below.
   • If the build is older than the fixed version for your OS release, treat it as vulnerable until patched.

3. Apply the correct fixed update (per OS)

   • Windows 10: fixed in 10.0.17763.9121; 10.0.19044.7663; 10.0.19045.7663
   • Windows 11: fixed in 10.0.22631.7517; 10.0.26100.9168; 10.0.26200.9168; 10.0.28000.2704
   • Windows Server 2019: fixed in 10.0.17763.9121
   • Windows Server 2022: fixed in 10.0.20348.5499
   • Windows Server 2025: fixed in 10.0.26100.33296
   • Reboot if your update process requires it (follow your normal Windows update policy).

4. Temporary workaround if patching is delayed

   • Restrict who can reach your DNS server: allow DNS traffic only from required internal systems and known management networks.
   • If possible in your environment, move DNS queries to a patched DNS server and limit direct access to the vulnerable one.

5. Validate after patching

   • Confirm the DNS servers now show the expected fixed build numbers.
   • Watch for service stability: DNS crashes/restarts, unusual spikes in DNS traffic, or abnormal error rates.

6. What to monitor over the next days

   • Unexpected inbound connections to DNS-related ports from unusual sources.
   • Event logs for DNS service failures, memory errors, or repeated crashes.
   • Any signs of persistence or privilege escalation (only if you have a reason to suspect an active compromise).

CVE-2026-62817 is assessed as HIGH (CVSS 8.8) and categorized under CWE-787 (out-of-bounds write). The weakness is an out-of-bounds memory write in Windows DNS, which can be triggered by a remote attacker over network adjacency and can lead to remote code execution.

Exploitation status: no KEV entry (not listed in CISA KEV) and no public exploit code is on record; however, the overall traffic-light verdict is RED. Patch status is known with multiple fixed build versions across Windows 10/11 and Windows Server 2019/2022/2025.

EPSS is predicted (0.6%, flat trend), but public owner guidance here should be driven primarily by the confirmed availability of patches and the RED priority rather than EPSS alone.

KEV meaning: because it is not in KEV, there is not (in the provided findings) an official CISA-confirmed exploitation indicator; still, due to the remote code execution nature of the flaw in a network-facing component, patching is critical.