---
id: "CVE-2026-119905"
page: "https://infrastack.ai/live/CVE-2026-119905"
kind: "vulnerability"
aliases: ["CVE-2026-119905"]
title: "Windows DNS: improper input validation lets an authorized attacker spoof"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "self-hosted", "windows", "windows-dns"]
not_affected_if: ["no-windows-dns-server"]
published_at: "2026-11-10T19:20:11+00:00"
first_seen_at: "2026-11-10T19:25:02+00:00"
updated_at: "2026-11-10T20:02:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119905", "first_seen_at": "2026-11-10T19:25:02+00:00"}]
exploit_sources: []
---

# Windows DNS: improper input validation lets an authorized attacker spoof

Link for people: https://infrastack.ai/live/CVE-2026-119905 (this .md is for agents)

Windows DNS does not properly validate input, so an attacker with some authorized access on the network can spoof DNS responses. The impact is that clients could be sent to attacker-chosen addresses.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:25:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119905

## From the sources

Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_