{"id":"CVE-2026-96020","kind":"vulnerability","aliases":["CVE-2026-96020"],"related":[],"title":"DNS Server: out-of-bounds write lets an authorized user run code remotely","description":"Out-of-bounds write in DNS Server allows an authorized attacker to execute code over a network.","summary":"An out-of-bounds write in a DNS Server lets an authenticated attacker run code over the network (CVSS 8.8, PR:L). The CVSS score comes from Microsoft (secure@microsoft.com), which suggests Windows DNS Server, but no source read so far names the product, versions or fix.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DNS Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dns-server","infrastructure","windows-server"],"not_affected_if":["no-dns-server-deployed"],"how_to_check":"Unknown until the vendor advisory is published. If you run Windows Server with the DNS Server role (Get-WindowsFeature DNS), also check whether the November 2026 cumulative update is installed, and check the MSRC Security Update Guide entry for CVE-2026-96020 for the exact builds.","fix":null,"status":"open","published_at":"2026-11-10T19:21:58+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","triaged_at":"2026-11-10T19:25:53+00:00","updated_at":"2026-11-10T20:08:04+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:25:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"DNS Server: out-of-bounds write lets an authorized user run code remotely","impact":"high","summary":"A memory-corruption flaw (out-of-bounds write) in a DNS Server lets an attacker with valid access run code over the network. The NVD entry gives a CVSS score of 8.8 (high) and does not name the product or versions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dns-server"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs code on the DNS server over the network","analyst_note":"Identify the vendor and product from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-96020), then find affected versions and the fix.","how_to_check":"unknown","plain_action":"","product_name":"DNS Server","needs_analyst":true,"not_affected_if":["no-dns-server-deployed"],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":4478,"output_tokens":410,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor and product from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-96020), then find affected versions and the fix.","search":"'-2026':16A,19A '-96020':17A,20A '8.8':50B 'allow':85C 'attack':43B,88C 'authent':42B 'author':10A,87C 'bound':6A,34B,80C 'code':13A,45B,91C 'come':56B 'cve':15A,18A 'cvss':49B,54B 'dns':1A,21A,24B,38B,63B,83C 'dns-server':23B 'execut':90C 'far':70B 'fix':76B 'infrastructur':26B 'l':52B 'let':8A,40B 'microsoft':58B 'name':71B 'network':48B,94C 'out-of-bound':3A,31B,77C 'pr':51B 'product':73B 'read':68B 'remot':14A 'run':12A,44B 'score':55B 'secure@microsoft.com':59B 'server':2A,22A,25B,29B,39B,64B,84C 'sourc':67B 'suggest':61B 'user':11A 'version':74B 'window':28B,62B 'windows-serv':27B 'write':7A,35B,81C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a DNS Server service are the ones to look at. The product is not confirmed: the CVSS source is Microsoft, so Windows Server with the DNS Server role is the likely candidate. The attacker needs valid low-privilege access, so internal and domain-joined DNS servers matter more than public-facing ones. Machines without a DNS server role can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["dnsserver","server"],"ptokens":["dns","server"],"labels":["dnsserver","high","infrastructure","vendor","windowsserver"],"campaign_type":null,"search_a":"'-2026':16A,19A '-96020':17A,20A 'author':10A 'bound':6A 'code':13A 'cve':15A,18A 'dns':1A,21A 'let':8A 'out-of-bound':3A 'remot':14A 'run':12A 'server':2A,22A 'user':11A 'write':7A","search_b":"'8.8':50B 'attack':43B 'authent':42B 'bound':34B 'code':45B 'come':56B 'cvss':49B,54B 'dns':24B,38B,63B 'dns-server':23B 'far':70B 'fix':76B 'infrastructur':26B 'l':52B 'let':40B 'microsoft':58B 'name':71B 'network':48B 'out-of-bound':31B 'pr':51B 'product':73B 'read':68B 'run':44B 'score':55B 'secure@microsoft.com':59B 'server':25B,29B,39B,64B 'sourc':67B 'suggest':61B 'version':74B 'window':28B,62B 'windows-serv':27B 'write':35B","search_c":"'allow':85C 'attack':88C 'author':87C 'bound':80C 'code':91C 'dns':83C 'execut':90C 'network':94C 'out-of-bound':77C 'server':84C 'write':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96020","severity":null,"published_at":"2026-11-10T19:21:58+00:00","modified_at":"2026-11-10T19:21:58+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","fetched_at":"2026-11-10T19:25:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96020:2612","url":null,"severity":null,"published_at":"2026-11-10T20:08:04+00:00","modified_at":"2026-11-10T20:08:04+00:00","first_seen_at":"2026-11-10T20:08:04+00:00","fetched_at":"2026-11-10T20:08:04+00:00","note":"Primary source not found: MSRC page for this id returns nothing yet, NVD page text is empty, searches show no vendor advisory. CVSS source is secure@microsoft.com and it was published on Patch Tuesday (Nov 10 2026), so it is probably a Windows DNS Server issue, but no page I read names the product, so I did not confirm it. Versions and fix unknown. Revisit once the MSRC entry is up."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}