CVE-2026-62881

Think of Windows DNS like the phonebook your network uses to translate names into IP addresses. This flaw is a mistake in how a number is handled during DNS operations; if a bad actor already has the right kind of access to the machine, they may be able to break out of that access and take full control.

This matters if you run or manage Windows DNS on Windows 10, Windows 11, or the listed Windows Server editions (2012/2012 R2/2016/2019/2022/2025). It’s most relevant when an attacker can already access the machine with authorized permissions (for example, an account compromise or other local access path). Because it’s a local flaw requiring the attacker to have specific permissions, it’s mainly a risk after someone gets local/authorized access—not from normal internet browsing.

This is RED because reporting indicates it’s being actively targeted in the wild in the context of a new patch, and the attacker capability is “local escalation to higher control,” which can turn an account compromise into full compromise. Even though there are no public details saying this exact CVE is the one used in widely cited articles, the patch attention and actor association mean you should treat this as urgent on any affected DNS systems.