{"id":"CVE-2026-119905","kind":"vulnerability","aliases":["CVE-2026-119905"],"related":[],"title":"Windows DNS: improper input validation lets an authorized attacker spoof","description":"Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network.","summary":"Windows DNS does not properly validate input, so an attacker with some authorized access on the network can spoof DNS responses. The impact is that clients could be sent to attacker-chosen addresses.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","self-hosted","windows","windows-dns"],"not_affected_if":["no-windows-dns-server"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:11+00:00","first_seen_at":"2026-11-10T19:25:02+00:00","triaged_at":"2026-11-10T20:02:52+00:00","updated_at":"2026-11-10T20:02:52+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:02:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DNS: improper input validation lets an authorized attacker spoof","impact":"medium","summary":"Windows DNS does not properly validate input, so an attacker with some authorized access on the network can spoof DNS responses. The impact is that clients could be sent to attacker-chosen addresses.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-dns","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"DNS answers are spoofed, redirecting clients to attacker-chosen hosts","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119905 for affected Windows versions, fixed builds and any mitigation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-windows-dns-server"],"who_is_affected":"Organizations running Windows DNS Server on their network. The sources do not describe the configuration required or which Windows versions are affected; the attacker must first hold some authorized access on the network.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":4481,"output_tokens":437,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119905':13A,16A '-2026':12A,15A 'access':38B 'address':58B 'allow':65C 'attack':9A,34B,56B,68C 'attacker-chosen':55B 'author':8A,37B,67C 'chosen':57B 'client':50B 'could':51B 'cve':11A,14A 'dns':2A,24B,26B,44B,64C 'host':20B 'impact':47B 'improp':3A,59C 'infrastructur':17B 'input':4A,31B,60C 'let':6A 'network':41B,74C 'perform':70C 'proper':29B 'respons':45B 'self':19B 'self-host':18B 'sent':53B 'spoof':10A,43B,71C 'valid':5A,30B,61C 'window':1A,21B,23B,25B,63C 'windows-dn':22B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Windows DNS Server on their network. The sources do not describe the configuration required or which Windows versions are affected; the attacker must first hold some authorized access on the network.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","selfhosted","windows","windowsdns"],"campaign_type":null,"search_a":"'-119905':13A,16A '-2026':12A,15A 'attack':9A 'author':8A 'cve':11A,14A 'dns':2A 'improp':3A 'input':4A 'let':6A 'spoof':10A 'valid':5A 'window':1A","search_b":"'access':38B 'address':58B 'attack':34B,56B 'attacker-chosen':55B 'author':37B 'chosen':57B 'client':50B 'could':51B 'dns':24B,26B,44B 'host':20B 'impact':47B 'infrastructur':17B 'input':31B 'network':41B 'proper':29B 'respons':45B 'self':19B 'self-host':18B 'sent':53B 'spoof':43B 'valid':30B 'window':21B,23B,25B 'windows-dn':22B","search_c":"'allow':65C 'attack':68C 'author':67C 'dns':64C 'improp':59C 'input':60C 'network':74C 'perform':70C 'spoof':71C 'valid':61C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119905","severity":null,"published_at":"2026-11-10T19:20:11+00:00","modified_at":"2026-11-10T19:20:11+00:00","first_seen_at":"2026-11-10T19:25:02+00:00","fetched_at":"2026-11-10T19:25:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}