{"id":"CVE-2026-96092","kind":"vulnerability","aliases":["CVE-2026-96092"],"related":[],"title":"Windows DNS Server: use-after-free lets an unauthenticated attacker run code","description":"Use after free in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"Use-after-free in the Windows DNS Server service. Per NVD (Microsoft's data), an unauthenticated network attacker can execute code; attack complexity is high (CVSS 8.1). Listed as affecting Windows Server 2025 and Server Core below build 10.0.26100.33822. No exploitation or PoC reported yet.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["dns-server","infrastructure","windows","windows-server-2025"],"not_affected_if":["no-dns-role","patched"],"how_to_check":"On each Windows Server 2025 host run: (Get-WindowsFeature DNS).Installed to see whether the DNS Server role is installed, and [System.Environment]::OSVersion.Version or winver to read the build. Exposed if DNS is installed and build is below 10.0.26100.33822. Whether the role must be enabled is not stated in the source; assume yes.","fix":"Install the November 2026 Windows Server 2025 cumulative update that brings the build to 10.0.26100.33822 or later (build from NVD/CNA data; KB number not confirmed, see MSRC advisory).","status":"open","published_at":"2026-11-10T19:22:07+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","triaged_at":"2026-11-10T19:34:31+00:00","updated_at":"2026-11-10T19:48:19+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-11-10T19:34:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DNS Server: use-after-free lets an unauthenticated attacker run code","impact":"high","summary":"A use-after-free bug in the Windows DNS Server role lets an attacker send crafted network requests that corrupt memory. A successful attack lets the attacker execute code on the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dns-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker executes code on the DNS server over the network","analyst_note":"Confirm affected Windows Server versions and whether the DNS Server role must be enabled, and find the vendor's patch from the NVD or Microsoft advisory.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000626,"input_tokens":4472,"output_tokens":357,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows Server versions and whether the DNS Server role must be enabled, and find the vendor's patch from the NVD or Microsoft advisory.","search":"'-2026':15A,18A '-96092':16A,19A '10.0.26100.33822':71B '2025':22A,31B,65B '8.1':59B 'affect':62B 'allow':84C 'attack':11A,50B,54B,87C 'build':70B 'code':13A,53B,90C 'complex':55B 'core':68B 'cve':14A,17A 'cvss':58B 'data':46B 'dns':2A,24B,39B,82C 'dns-server':23B 'execut':52B,89C 'exploit':73B 'free':7A,35B,80C 'high':57B 'infrastructur':26B 'let':8A 'list':60B 'microsoft':44B 'network':49B,93C 'nvd':43B 'per':42B 'poc':75B 'report':76B 'run':12A 'server':3A,21A,25B,30B,40B,64B,67B,83C 'servic':41B 'unauthent':10A,48B 'unauthor':86C 'use':5A,33B,78C 'use-after-fre':4A,32B 'window':1A,27B,29B,38B,63B 'windows':20A 'windows-serv':28B 'yet':77B","nicknames":[],"mitigations":[],"who_affected":"Servers running Windows Server 2025 (including Server Core) with the DNS Server role, below build 10.0.26100.33822. Domain controllers with integrated DNS are the main systems to look at. Hosts without the DNS Server role, and other Windows versions (none listed so far), can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["server2025","windowsserver2025"],"ptokens":["2025","server","windows"],"labels":["dnsserver","high","infrastructure","windows","windowsserver2025"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96092':16A,19A '2025':22A 'attack':11A 'code':13A 'cve':14A,17A 'dns':2A 'free':7A 'let':8A 'run':12A 'server':3A,21A 'unauthent':10A 'use':5A 'use-after-fre':4A 'window':1A 'windows':20A","search_b":"'10.0.26100.33822':71B '2025':31B,65B '8.1':59B 'affect':62B 'attack':50B,54B 'build':70B 'code':53B 'complex':55B 'core':68B 'cvss':58B 'data':46B 'dns':24B,39B 'dns-server':23B 'execut':52B 'exploit':73B 'free':35B 'high':57B 'infrastructur':26B 'list':60B 'microsoft':44B 'network':49B 'nvd':43B 'per':42B 'poc':75B 'report':76B 'server':25B,30B,40B,64B,67B 'servic':41B 'unauthent':48B 'use':33B 'use-after-fre':32B 'window':27B,29B,38B,63B 'windows-serv':28B 'yet':77B","search_c":"'allow':84C 'attack':87C 'code':90C 'dns':82C 'execut':89C 'free':80C 'network':93C 'server':83C 'unauthor':86C 'use':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96092","severity":null,"published_at":"2026-11-10T19:22:07+00:00","modified_at":"2026-11-10T19:22:07+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","fetched_at":"2026-11-10T19:25:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96092:2555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96092","severity":null,"published_at":"2026-11-10T19:48:19+00:00","modified_at":"2026-11-10T19:48:19+00:00","first_seen_at":"2026-11-10T19:48:19+00:00","fetched_at":"2026-11-10T19:48:19+00:00","note":"Read NVD record (Microsoft CNA data): only Windows Server 2025 incl. Server Core, 10.0.26100.0 to <10.0.26100.33822 listed. MSRC page is JS-only, CVFR feed too large; KB number, DNS-role requirement and exploitation status not confirmed from vendor text. Nothing verified. No X/search done; no check written (needs role/build, not repo-readable).","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96092"]}],"documents":[{"id":117692,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96092","title":"NVD CVE-2026-96092 (CNA data from Microsoft)","kind":"advisory","source":"analyst","publisher":null,"text":"Use after free in DNS Server allows an unauthorized attacker to execute code over a network. Affected: Windows Server 2025 and Server Core (x64) 10.0.26100.0 before 10.0.26100.33822. CVSS 3.1 8.1 AV:N/AC:H/PR:N. CWE-416.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}