CVE-2026-50495

What it actually does

CVE-2026-50495 is a local improper access control vulnerability in Microsoft Windows DNS. A low-privileged, already-authenticated local attacker can bypass intended authorization checks and tamper with DNS-related configuration or state that should require higher privileges. The reported impact is primarily integrity loss, with some availability impact, and no direct confidentiality impact. Because exploitation requires local access and valid low-privileged credentials, this is most relevant as a post-compromise or insider-risk vulnerability rather than an initial remote entry point.

Why it matters to the business

Successful exploitation could allow an attacker who already has access to a Windows system to alter DNS behavior, potentially redirecting traffic, disrupting name resolution, weakening security controls that depend on DNS, or interfering with services that rely on accurate domain lookup. On workstations this may enable phishing, traffic interception, or persistence-supporting changes; on servers, especially systems providing DNS-dependent services, it may cause operational disruption or misrouting. The vulnerability is not currently listed in CISA KEV and no public exploit maturity is reported, but it affects many supported Windows desktop and server versions, so patching should be included in normal Windows update cycles and prioritized for DNS servers, domain controllers, administrative workstations, and shared multi-user systems.

How an attack unfolds

An attacker first obtains low-privileged local access to an affected Windows host, such as through stolen credentials, malware execution, remote desktop access, or insider access. From that foothold, the attacker interacts with Windows DNS-related components in a way that bypasses expected access control restrictions. Instead of being blocked from modifying protected DNS behavior or configuration, the attacker is able to tamper with DNS-related data locally. The attacker may then redirect selected name lookups, interfere with resolution, or create conditions that disrupt dependent applications and services. In a broader intrusion, this could support credential theft, traffic redirection, evasion, or lateral movement by influencing how the compromised host or service resolves trusted names.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-50495 for all affected Windows versions, including Windows 10 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2019, 2022, and 2025. No fixed build numbers were provided in the input, so administrators should use the relevant Microsoft Security Update Guide entry, Windows Update, WSUS, Microsoft Configuration Manager, or other patch-management tooling to deploy the latest cumulative update for the affected platform. Prioritize systems where DNS integrity is critical, including DNS servers, domain controllers, management servers, VDI/shared hosts, jump boxes, and administrative workstations. As compensating controls, restrict local logon rights, remove unnecessary local administrator or power-user access, monitor and limit who can change DNS settings, enforce endpoint protection controls, and use configuration baselines or Group Policy to prevent unauthorized resolver changes.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative update or security update released to remediate this vulnerability. Validate through centralized patch inventory, Windows Update history, WSUS/Configuration Manager compliance reports, or PowerShell queries such as checking installed hotfixes and OS build levels against Microsoft’s official fixed build guidance. On high-value systems, verify that DNS client/server configuration matches approved baselines, including DNS server addresses, suffix search lists, hosts file contents, NRPT rules, DNS Server role settings, and relevant registry-backed DNS parameters. Test that standard low-privileged users cannot modify protected DNS configuration or DNS server state. Where feasible, run authenticated vulnerability scanning after patch deployment to confirm the CVE is no longer reported.

Typical attack path

1. Gain authenticated local access to an affected Windows workstation or server with low privileges.
2. Identify whether the host uses vulnerable Windows DNS components or DNS-related local configuration paths.
3. Invoke the vulnerable DNS functionality locally to bypass intended authorization checks.
4. Tamper with DNS-related configuration, records, cache, or resolver behavior accessible through the flaw.
5. Use the modified DNS behavior to redirect traffic, disrupt service resolution, support credential capture, or assist lateral movement.
6. Optionally clean up visible changes or restore prior state after achieving the objective.

How to detect it

Look for evidence of suspicious local DNS tampering on affected Windows hosts, especially after low-privileged logons, malware execution, or unusual administrative activity. Useful log sources include Windows Security logs for local and remote logons, privilege use, process creation if enabled, PowerShell logs, Sysmon telemetry, Microsoft Defender for Endpoint or other EDR process/file/registry events, DNS Client operational logs, DNS Server logs on systems running the DNS Server role, and configuration-management drift reports. Investigate changes to DNS server addresses, DNS suffix search lists, Name Resolution Policy Table rules, DNS Server zones/records, DNS cache behavior, and the Windows hosts file. Correlate DNS configuration changes with commands such as ipconfig, netsh, dnscmd, PowerShell DNS cmdlets, registry modification tools, or unexpected processes writing DNS-related registry keys and files. Because the public description does not disclose a precise exploit primitive, detection should focus on unauthorized DNS state changes and suspicious local activity rather than a single definitive exploit signature.

• C:\Windows\System32\drivers\etc\hosts
• dnscmd.exe
• netsh.exe interface ip set dns
• netsh.exe interface ipv4 set dns
• netsh.exe interface ipv6 set dns
• Set-DnsClientServerAddress
• Set-DnsClientGlobalSetting
• Add-DnsClientNrptRule
• Set-DnsClientNrptRule
• Remove-DnsClientNrptRule
• Clear-DnsClientCache
• ipconfig.exe /flushdns
• HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer
• HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SearchList
• HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
• HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
• HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters
• Microsoft-Windows-DNS-Client/Operational
• Microsoft-Windows-DNSServer/Audit
• Event ID 4663
• Event ID 4688
• Event ID 4657

What your security team should do

• Prioritize patching on Windows DNS servers, domain controllers, administrative workstations, shared servers, and systems exposed to multiple local users.
• Deploy the latest Microsoft cumulative security updates for all affected Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 assets.
• Review local user, Remote Desktop, service account, and interactive logon permissions to reduce the number of accounts capable of local exploitation.
• Monitor for unauthorized DNS configuration changes, especially changes to DNS server addresses, DNS suffixes, NRPT rules, hosts file entries, and DNS Server role settings.
• Use endpoint detection and response telemetry to correlate suspicious local DNS tampering with prior credential theft, malware execution, or lateral movement activity.
• Establish or refresh configuration baselines for DNS client and server settings and alert when endpoints deviate from approved values.
• Because there is no current KEV listing or known exploit maturity, treat this as important patch hygiene rather than an emergency internet-facing remote-code-execution event, unless high-value DNS infrastructure is affected.