CVE-2026-50426

What it actually does

The vulnerability is a relative path traversal flaw in Microsoft Windows DNS Server. An authenticated attacker on an adjacent network can supply crafted path input that is not properly normalized by the DNS Server component, allowing filesystem access outside the intended directory. According to the assigned impact, successful exploitation can lead to remote code execution with high confidentiality, integrity, and availability impact on the DNS server host.

Why it matters to the business

Compromise of a Windows DNS server can affect core network operations because DNS is required for application access, authentication workflows, domain services, and user connectivity. An attacker who gains code execution on a DNS server may disrupt name resolution, redirect traffic, access sensitive data, or use the server as a foothold for lateral movement. Although exploitation requires high privileges and adjacent network access, the operational impact is significant because the affected products include multiple supported Windows Server and Windows client versions, and the issue has been public for 28 days.

How an attack unfolds

An attacker first obtains authorized access with sufficient privileges and positions themselves on an adjacent network segment that can reach the vulnerable DNS Server service. They then interact with the DNS Server using a crafted request or administrative operation containing relative path traversal sequences. If the vulnerable server fails to constrain the resolved path to the expected DNS Server directory, the attacker can cause the service to access or modify files outside the intended location. By placing, overwriting, or influencing files that are later executed or loaded by the DNS Server or operating system, the attacker can achieve code execution on the server. From there, the attacker may run commands under the service context, alter DNS behavior, disrupt resolution, or pivot to other systems.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows DNS Server installations, including Windows Server 2012, 2016, 2019, 2022, 2025, and affected Windows 10 versions where DNS Server components are present. Because no exact fixed build numbers were provided in the input, use Microsoft Security Update Guide, WSUS, Microsoft Configuration Manager, Windows Update for Business, or equivalent patch management tooling to identify and deploy the update for CVE-2026-50426. As compensating controls, restrict DNS Server administration to dedicated management networks, limit access to TCP/UDP 53 and DNS management interfaces to trusted systems, enforce least privilege for DNS administrators, disable unnecessary DNS Server features, use secure dynamic updates where applicable, and monitor DNS Server directories and configuration for unauthorized changes.

How to confirm the fix worked

Confirm that each affected host has installed the Microsoft security update that remediates this vulnerability by checking installed KBs, OS build numbers, and patch compliance status against Microsoft Security Update Guide. Verify that DNS Server is not unnecessarily exposed to adjacent or untrusted network segments and that firewall rules restrict DNS management access. Review DNS Server configuration to confirm only authorized administrators can make changes. Validate that DNS resolution continues to operate normally after patching. Where possible, perform authenticated vulnerability scanning or configuration assessment to confirm the vulnerable Windows DNS Server versions are no longer present.

Typical attack path

1. Obtain valid credentials or privileges sufficient to perform the vulnerable DNS Server operation.
2. Gain network position on an adjacent segment that can communicate with the Windows DNS Server.
3. Send a crafted DNS Server request or management action containing relative path traversal sequences such as parent-directory references.
4. Cause the DNS Server to resolve a file path outside the intended directory.
5. Use the out-of-bounds file access to place, overwrite, or influence executable content or configuration.
6. Trigger execution or loading of the attacker-controlled content.
7. Use resulting code execution to persist, disrupt DNS, redirect traffic, collect sensitive information, or move laterally.

How to detect it

Investigate whether this was already exploited by reviewing Windows DNS Server logs, Windows Security logs, Sysmon or EDR telemetry, DNS Server configuration change records, and file integrity monitoring on DNS-related directories. Focus on activity from adjacent network sources or administrative accounts performing unusual DNS Server operations, especially around the time of unexpected service restarts, DNS configuration changes, or suspicious file writes. Review Windows Event Logs for DNS Server service failures, unexpected restarts, zone or configuration modifications, and administrative actions by unusual accounts. Examine process telemetry for dns.exe spawning child processes, loading unexpected files, or writing outside normal DNS Server directories. Look for path traversal patterns in captured management traffic, DNS-related logs, EDR command-line telemetry, and application logs, including parent-directory references and URL-encoded traversal variants. Because there is no public exploit maturity or known KEV listing in the provided data, treat detections as behavioral rather than signature-complete.

• ..\\
• ../
• %2e%2e%5c
• %2e%2e%2f
• dns.exe
• C:\\Windows\\System32\\dns.exe
• C:\\Windows\\System32\\dns
• Microsoft-Windows-DNS-Server-Service
• Microsoft-Windows-DNS-Server/Audit
• Microsoft-Windows-DNS-Server/Operational

What your security team should do

• Prioritize patching Windows DNS Server systems because successful exploitation can result in code execution on critical infrastructure.
• Inventory all Windows systems running the DNS Server role, including legacy Windows Server 2012 and 2016 systems that may be harder to patch.
• Restrict DNS Server management access to trusted administrative networks and block unnecessary adjacent-network access.
• Review DNS administrator group membership and remove unnecessary high-privilege accounts.
• Enable or review DNS Server analytical, audit, and operational logging where feasible to improve post-exploitation visibility.
• Monitor for suspicious file writes, configuration changes, or process creation events involving the DNS Server service.
• After remediation, run authenticated vulnerability scans or patch compliance checks to confirm the update is deployed everywhere.