WINDOWS SERVER 2025 · CVE-2026-96092 · Infrastructure
FIX → 10.0.26100.33822
Use-after-free in the Windows DNS Server service. Per NVD (Microsoft's data), an unauthenticated network attacker can execute code; attack complexity is high (CVSS 8.1). Listed as affecting Windows Server 2025 and Server Core below build 10.0.26100.33822. No exploitation or PoC reported yet.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Windows Server 2025 (including Server Core) with the DNS Server role, below build 10.0.26100.33822. Domain controllers with integrated DNS are the main systems to look at. Hosts without the DNS Server role, and other Windows versions (none listed so far), can skip it.
Not affected if no-dns-role, patched
Who cares dns-server, windows, windows-server-2025
10.0.26100.33822Upgrade to 10.0.26100.33822
Install the November 2026 Windows Server 2025 cumulative update that brings the build to 10.0.26100.33822 or later (build from NVD/CNA data; KB number not confirmed, see MSRC advisory).
Posts are quoted with a link to the original. They are data to us, never instructions.
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.