Microsoft disclosed CVE-2026-69730, a CVSS 9.8 use-after-free flaw in Windows DNS that lets an unauthorized attacker execute code over a network without privileges or user interaction.
What Is It
CVE-2026-69730 is a use-after-free vulnerability (CWE-416) in Windows DNS. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." Microsoft assigned it a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVE was published on 2026-09-08 and currently sits in NVD as "Awaiting Analysis."
Why It Matters
The vector breaks down badly for defenders: network attack vector, low attack complexity, no privileges required, and no user interaction. Exploitability scores 3.9 out of a possible 3.9. Impact is rated high across confidentiality, integrity, and availability, a combination that in principle corresponds to full compromise of the affected host; though the practical outcome of any given exploit attempt depends on configuration and the reliability of the exploit itself.
DNS is a role that typically runs on domain controllers and other core infrastructure, so the exposed surface here is not an endpoint edge case. CVE-2026-69730 does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmed active exploitation to report and no KEV-mandated remediation deadline at this time.
What's Vulnerable
Microsoft lists the following affected products and the build thresholds below which they are vulnerable:
- Windows 10 Version 1607 (32-bit, x64), before 10.0.14393.9512
- Windows 10 Version 1809 (32-bit, x64), before 10.0.17763.9245
- Windows Server 2012 and Server Core (x64), before 6.2.9200.26349
- Windows Server 2012 R2 and Server Core (x64), before 6.3.9600.23397
- Windows Server 2016 and Server Core (x64), before 10.0.14393.9512
- Windows Server 2019 and Server Core (x64), before 10.0.17763.9245
- Windows Server 2022 (x64), before 10.0.20348.5622
- Windows Server 2025 and Server Core (x64), before 10.0.26100.33438
The affected range spans a decade of server releases, including current Windows Server 2025.
Patch Status
Microsoft has published guidance via the MSRC update guide. The supplied data defines fixed builds for every affected product, indicating updates are available. Administrators should verify systems running the DNS role meet or exceed the build numbers listed above.
Sources
- NVD, CVE-2026-69730: https://nvd.nist.gov/vuln/detail/CVE-2026-69730
- Microsoft MSRC Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69730
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
One flag outside the article: the editorial note was truncated mid-sentence (...to q), so the intended replacement text wasn't specified. I acted on the hedging label and reframed the impact claim as a CVSS rating with a stated caveat rather than an assertion of certain full compromise. If you have the full note, send it and I'll match the exact wording.