DNS Security
DNS Security Alert: Wormable Windows DNS RCE
Published September 10, 2026 · DNS Benchmark Pro Editorial · Reading time: 6 minutes
TL;DR — Microsoft’s September 2026 Patch Tuesday, released 8 September, fixed a record 974 CVEs. The DNS security headline is CVE-2026-69730, a CVSS 9.8 remote code execution flaw in Windows DNS Server that the Zero Day Initiative calls the “spiritual successor” to SigRed (CVE-2020-1350). It is one of 20 wormable bugs shipped in a single month — alongside DHCP Server, Active Directory, Netlogon, SMB Client, RRAS and IP Helper. Two unrelated privilege-escalation flaws, CVE-2026-85880 and CVE-2026-81963, are already exploited in the wild and now sit in CISA’s KEV catalog with a 22 September federal deadline. Patch domain controllers first.
Every so often a DNS security bug arrives that is less about privacy and more about survival. CVE-2026-69730 is that kind of bug. It is an unauthenticated remote code execution vulnerability in the Windows DNS Server role, reachable by sending a crafted packet over the network, with no user interaction and no credential required. On a Windows estate, that role almost always runs on a domain controller. Code execution on the DNS service is therefore code execution on the identity plane.
Why CVE-2026-69730 earns the SigRed comparison
SigRed, disclosed in July 2020, was a 17-year-old heap overflow in Microsoft’s DNS server that carried a CVSS 10.0 and prompted an emergency out-of-band advisory. Its danger was never the parsing bug itself — it was where the vulnerable code lived. A DNS server that resolves recursively will happily fetch a response from an attacker-controlled authoritative name server, which means the attacker chooses the bytes the parser sees without ever needing a route into the network.
Dustin Childs of the Zero Day Initiative applied the same framing to CVE-2026-69730 this week, noting that the industry has not seen a global worm in years, “but with a DNS flaw acting as the spiritual successor to SigRed, that reality could change fast.” The CVSS 9.8 vector — network attack, low complexity, no privileges, no user interaction — is the profile that turns a zero-day vulnerability into self-propagating malware, because the exploit primitive and the propagation mechanism are the same thing.
Twenty wormable flaws in one release
The DNS bug does not stand alone. Microsoft patched roughly 20 vulnerabilities this month that meet the wormable bar: remote, unauthenticated, arbitrary code execution, zero interaction. The affected components read like a map of the Windows network stack.
| Component | Why it matters |
|---|---|
| Windows DNS Server (CVE-2026-69730, CVSS 9.8) | Recursive resolution lets an attacker supply the parsed bytes; usually co-located with a domain controller. |
| DHCP Server | Controls the resolver addresses clients trust — a direct path to DNS security compromise without touching DNS itself. |
| Active Directory / Netlogon | Domain-wide authority; a foothold here is a foothold everywhere. |
| SMB Client, NFS, RRAS, IP Helper, Message Queuing | Classic lateral-movement and edge services, frequently exposed further than administrators believe. |
Remote Desktop Services adds CVE-2026-69525, a CVSS 9.8 use-after-free that an unauthenticated in-network attacker can use for code execution. Exchange Server contributes CVE-2026-55007 — unauthenticated RCE triggered when the server indexes a malicious Visio attachment, exploitable only under sustained memory pressure — and CVE-2026-69380 (CVSS 8.1), which lets a low-privileged account impersonate any user in the organisation.
The two flaws already under attack
Neither actively exploited zero-day vulnerability this month is remote. Both are local privilege escalations to SYSTEM, and both carry CVSS 7.8.
- CVE-2026-85880 — a heap buffer overflow in Windows Advanced Local Procedure Call, affecting Windows 10 and Server 2012 through 2022. Reported by Proofpoint; only the second exploited ALPC zero-day since January 2023. CrowdStrike notes this class of flaw is a staple of post-compromise tooling as the step from user mode to kernel control.
- CVE-2026-81963 — improper link resolution in the Windows Update Stack, affecting Windows 11 and Server 2025. Reported by Microsoft’s own threat intelligence centre. Tenable counts seven Update Stack escalation flaws since 2022; this is the first confirmed exploited. ZDI’s reading is that it is being chained with a code execution bug rather than compromising the update channel itself.
CISA added both to the Known Exploited Vulnerabilities catalog, giving federal civilian agencies until 22 September 2026 to remediate. Private-sector IT security teams should treat that date as a sensible ceiling rather than a floor.
Prioritisation beats patch counts
The 974 figure is partly an artefact of AI-assisted code auditing inside Microsoft, which has driven monthly counts upward all year. Tenable’s Satnam Narang put it precisely: the haystacks are larger, but the number of needles has not moved. Fifty-eight of this month’s fixes are rated “Exploitation More Likely,” and ZDI notes that the CVE spike has not yet produced a matching spike in active exploitation. Reachability and exposure, not raw CVSS, should drive the order in which you deploy.
What a compromised DNS server actually costs you
Ranking CVE-2026-69730 above the exploited zero-days is a judgement about blast radius. An attacker with code execution inside the DNS service does not need to steal anything to cause damage. Four consequences follow directly, and none of them are detectable from the endpoint.
- Answer manipulation. A single altered record for an SSO endpoint, an update server or an internal certificate authority reroutes traffic organisation-wide while every client behaves normally.
- Identity-plane persistence. Because the DNS role usually shares a host with Active Directory, DNS compromise is domain compromise, and a rebuild of the DNS service does not evict an attacker who has already minted credentials.
- Availability collapse. A crashed or poisoned internal resolver is indistinguishable from a network outage to every application that depends on name resolution — which, in a modern estate, is all of them. Recovery is also slower, because failure looks like network latency long before it looks like an intrusion.
- Attack infrastructure. Compromised recursive resolvers are durable amplification sources for DDoS attack traffic, and a wormable primitive builds that population automatically.
The structural defence has not changed. Internal resolvers should not be reachable from the internet; recursion should be restricted to known client ranges; and the resolution path clients depend on should be verified independently rather than assumed. Endpoints that use DNS over HTTPS to a pinned, authenticated resolver validate resolver identity through TLS rather than through whatever the network advertises — a useful containment layer, though not a substitute for patching the server itself.
What to do this week
- Patch domain controllers first. The DNS, DHCP, Netlogon and Active Directory fixes are bundled in the cumulative update, so a single rollup closes most of the wormable cluster.
- Audit DNS exposure. Confirm no internal resolver answers recursive queries from arbitrary sources, and that UDP/TCP 53 is not reachable from the internet on any server infrastructure you own.
- Then Exchange and RDS. CVE-2026-55007 and CVE-2026-69525 are the next tier, particularly anywhere either service is internet-facing.
- Verify resolution after patching. A network diagnostic tool run from inside the network confirms in minutes which resolvers are answering and what latency they carry — the fastest way to catch a change nobody documented.
- Watch for a PoC. The researcher publishing under the Nightmare Eclipse handle released ShieldCrash, a bypass for this month’s Defender patch, within hours of release. Assume the DNS diff is being studied now.
Industry impact: DNS is production infrastructure
The wider lesson runs past Microsoft. DNS is treated as plumbing — installed once, rarely inventoried, patched on the same schedule as a file server — while carrying an authority that matches identity providers and certificate authorities. The MikroTik RouterOS exploitation we covered yesterday made the same point from the edge: whoever controls resolution controls the network, whether the box is labelled router or server.
CVE-2026-69730 has not been exploited in the wild as of publication, and it may never be. But the conditions that made SigRed a five-alarm event in 2020 are present again, and a patch that exists is not a patch that is deployed. Sound DNS security in 2026 means treating the resolver as a tier-zero asset, keeping cloud security and on-premises DNS under the same inventory, and measuring what your network actually resolves rather than trusting the configuration you wrote.
Sources: Microsoft Security Update Guide, September 2026; Zero Day Initiative, “The September 2026 Security Update Review” (8 September 2026); Help Net Security, “September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor” (9 September 2026); Security Affairs, “Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs” (9 September 2026); BleepingComputer and SecurityWeek Patch Tuesday coverage (9 September 2026); CrowdStrike Patch Tuesday analysis, September 2026; CISA Known Exploited Vulnerabilities catalog. This article is independent editorial analysis and is not affiliated with or endorsed by Microsoft, CISA or the Zero Day Initiative.