CVE-2026-96092: Windows Server 2025 DNS Server Use-After-Free Allows Unauthenticated Remote Code Execution (CVSS 8.1)
A use-after-free in the Windows Server 2025 DNS Server role lets an unauthenticated attacker run code with a crafted packet if they win a race condition; patch domain controllers with KB5131080.
What happened
Microsoft's November 2026 Patch Tuesday fixes CVE-2026-96092, a remote code execution vulnerability in the DNS Server role on Windows Server 2025. An attacker who can reach the DNS service over the network can, in theory, run code on the server without logging in and without any user interaction.
In the CVE feed the flaw appears as "Microsoft Windows Server 2025: Use after free". Microsoft's own title is Windows Domain Name Service Remote Code Execution Vulnerability.
The vulnerability
- CVE: CVE-2026-96092
- Type: use after free (CWE-416) in the Windows DNS Server
- CVSS 3.1: 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Microsoft severity: Important
- Impact: remote code execution
- Affected: Windows Server 2025 and Windows Server 2025 (Server Core installation), only where the DNS Server role is installed
- Exploitation: not publicly disclosed, not exploited, rated "Exploitation Unlikely"
A use-after-free bug happens when software keeps using a piece of memory after it has been released. An attacker who can control what gets written into that freed memory can sometimes hijack the program's execution.
Microsoft says an unauthenticated attacker could exploit the flaw by sending a specially crafted packet to the DNS service. The catch is the high attack complexity: the attacker has to win a race condition, hitting a narrow timing window for the attack to work. That makes reliable exploitation much harder, and it is why the score is 8.1 rather than 9.8.
Why it still matters
DNS servers on Windows are usually domain controllers. In most Active Directory environments the DNS Server role runs on the same machines that hold every account and password hash in the domain. Code execution in the DNS service on a domain controller means code execution on the most sensitive server in the network.
Windows DNS has a history here. Earlier wormable DNS flaws showed how quickly attackers and researchers turn up when Microsoft patches the DNS Server. "Exploitation Unlikely" is an assessment at release time, not a guarantee. Race conditions tend to get more reliable once researchers study the patch.
The good news is that the exposure is narrow: only Windows Server 2025 with the DNS role. Older Windows Server versions and Windows client PCs are not listed as affected.
The fix
Microsoft has released two update paths for Windows Server 2025:
- KB5131080: the regular November 2026 security update (needs a reboot)
- KB5131077: the security hotpatch for systems enrolled in Windows Server hotpatching, which applies the fix without a reboot
Microsoft marks the CVE as Customer Action Required: the fix only applies once the update is installed.
What to do
- Find your Windows Server 2025 DNS servers. Check every domain controller and any standalone DNS servers.
- Install KB5131080, or KB5131077 if you use hotpatching. Domain controllers running DNS come first.
- Don't expose Windows DNS to the internet. Internal Windows DNS servers should only accept queries from your own networks. Public-facing DNS should live on dedicated, hardened infrastructure.
- Restrict who can reach UDP/TCP port 53 on domain controllers with firewall rules and network segmentation.
- Watch for DNS service crashes. A failed race-condition attempt is likely to crash the DNS service. Unexpected restarts of
dns.exein the event logs are worth investigating.
Bottom line
CVE-2026-96092 is not the loudest bug of this Patch Tuesday: it is hard to exploit and not under attack. But it is an unauthenticated network RCE in a service that usually runs on domain controllers. If you run Windows Server 2025 domain controllers, include this update in this week's patch cycle rather than leaving it for later.
