{"id":"CVE-2026-96177","kind":"vulnerability","aliases":["CVE-2026-96177"],"related":[],"title":"Windows DNS Server: use-after-free lets an unauthenticated attacker run code","description":"Use after free in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"A use-after-free bug in the Microsoft DNS Server component lets an unauthorized attacker run code over the network. The sources give a CVSS score of 8.1 but name no affected versions or fix.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-server","infrastructure","windows","windows-server"],"not_affected_if":["no-dns-server-role"],"how_to_check":"Unknown until MSRC lists affected builds. Only systems with the Windows DNS Server role installed are relevant (Get-WindowsFeature DNS). Compare the build against the November 2026 cumulative update in the MSRC entry for CVE-2026-96177.","fix":null,"status":"open","published_at":"2026-11-10T19:22:17+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","triaged_at":"2026-11-10T19:34:30+00:00","updated_at":"2026-11-10T19:39:48+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:34:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DNS Server: use-after-free lets an unauthenticated attacker run code","impact":"high","summary":"A use-after-free bug in the Microsoft DNS Server component lets an unauthorized attacker run code over the network. The sources give a CVSS score of 8.1 but name no affected versions or fix.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dns-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the DNS server over the network","analyst_note":"Confirm affected Windows Server versions and the Microsoft security update from the NVD entry and the MSRC advisory; sources give no products or fix.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000628,"input_tokens":4472,"output_tokens":361,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows Server versions and the Microsoft security update from the NVD entry and the MSRC advisory; sources give no products or fix.","search":"'-2026':15A,18A '-96177':16A,19A '8.1':56B 'affect':60B 'allow':70C 'attack':11A,43B,73C 'bug':33B 'code':13A,45B,76C 'compon':39B 'cve':14A,17A 'cvss':53B 'dns':2A,21B,37B,68C 'dns-server':20B 'execut':75C 'fix':63B 'free':7A,32B,66C 'give':51B 'infrastructur':23B 'let':8A,40B 'microsoft':36B 'name':58B 'network':48B,79C 'run':12A,44B 'score':54B 'server':3A,22B,27B,38B,69C 'sourc':50B 'unauthent':10A 'unauthor':42B,72C 'use':5A,30B,64C 'use-after-fre':4A,29B 'version':61B 'window':1A,24B,26B 'windows-serv':25B","nicknames":[],"mitigations":[],"who_affected":"Windows servers running the DNS Server role are the systems to look at: the bug is a use-after-free reachable over the network without authentication (CVSS 8.1, high attack complexity). Exact Windows versions are not confirmed yet. Machines without the DNS Server role, and clients that only use DNS, can likely skip it once MSRC confirms.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsserver","high","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96177':16A,19A 'attack':11A 'code':13A 'cve':14A,17A 'dns':2A 'free':7A 'let':8A 'run':12A 'server':3A 'unauthent':10A 'use':5A 'use-after-fre':4A 'window':1A","search_b":"'8.1':56B 'affect':60B 'attack':43B 'bug':33B 'code':45B 'compon':39B 'cvss':53B 'dns':21B,37B 'dns-server':20B 'fix':63B 'free':32B 'give':51B 'infrastructur':23B 'let':40B 'microsoft':36B 'name':58B 'network':48B 'run':44B 'score':54B 'server':22B,27B,38B 'sourc':50B 'unauthor':42B 'use':30B 'use-after-fre':29B 'version':61B 'window':24B,26B 'windows-serv':25B","search_c":"'allow':70C 'attack':73C 'code':76C 'dns':68C 'execut':75C 'free':66C 'network':79C 'server':69C 'unauthor':72C 'use':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96177","severity":null,"published_at":"2026-11-10T19:22:17+00:00","modified_at":"2026-11-10T19:22:18+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","fetched_at":"2026-11-10T19:25:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96177:2534","url":null,"severity":null,"published_at":"2026-11-10T19:39:48+00:00","modified_at":"2026-11-10T19:39:48+00:00","first_seen_at":"2026-11-10T19:39:48+00:00","fetched_at":"2026-11-10T19:39:48+00:00","note":"Could not read MSRC page (JS-only, empty) and NVD page has no content; no primary source for affected builds or KB. Search hits are sibling DNS CVEs (69730, 77505, 72987), not this one, so none copied. Nothing verified. Revisit when MSRC/NVD populate: need per-release fixed builds from November 2026 Patch Tuesday."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}