The One DNS Patch That's Actually Wormable: Inside CVE-2026-62878 on Windows DNS Server
Today’s earlier post covered two VPN gateway incidents already being exploited in the wild, one with a real ransomware chain behind it. This one is the opposite shape of urgency: nothing observed exploited yet, no public proof-of-concept, but a bug class old enough that most of the industry assumed it was mostly engineered out by now, landing at CVSS 9.8 on a service that in most Active Directory environments runs directly on the domain controller.
August 2026 Patch Tuesday shipped four separate Windows DNS Server remote code execution fixes: CVE-2026-62817 (8.8), CVE-2026-62820 (8.1), CVE-2026-65789 (8.1), and CVE-2026-62878 (9.8). Zero Day Initiative’s own Patch Tuesday review, written by Dustin Childs, singled out the last one specifically: “There are several DNS-related patches this month, but this one stands out by far… It’s a good ol’ fashioned stack-based buffer overflow that ends up wormable. Microsoft states exploitation is less likely, but I wouldn’t count on that. I suggest testing and deploying this one quickly, especially to your Internet-facing DNS servers.”
What’s actually known
Microsoft’s own advisory text is deliberately thin, which is standard practice for an unpatched-in-the-wild bug: “Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.” The formal classification is CWE-121, stack-based buffer overflow, one of the oldest and most thoroughly studied bug classes in software security. The CVSS 3.1 vector, per Microsoft’s own submission to NVD, is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-reachable, low attack complexity, no privileges required, no user interaction, and complete impact to confidentiality, integrity, and availability. Every metric in that vector is the worst-case option except scope, which stays unchanged because the DNS Server process itself is the whole blast radius. That combination, reachable over the network with nothing required from a victim, is exactly what “wormable” means in practice: a piece of self-propagating code could scan for exposed DNS servers and exploit each one without a human anywhere in the loop, the same shape of bug that made EternalBlue and WannaCry possible in 2017.
One detail worth flagging that didn’t make it into most of the day-one coverage, because it requires reading NVD’s raw change history rather than the advisory summary: CISA’s own automated exploitation-prediction scoring (SSVC) flagged this CVE’s “automatable” field as “yes” within hours of publication on August 11, then revised it back to “no” the following day. Exploitation status has stayed “none observed” throughout. It’s a small thing, but it’s a useful reminder that even the automated pipelines built specifically to triage this kind of bug don’t converge instantly, and a same-day severity read on any CVE is provisional by nature.
Why “DNS Server” often means “domain controller”
In most Active Directory deployments, the DNS Server role isn’t a standalone appliance somewhere off to the side. It runs on the domain controllers themselves, using AD-integrated zones so DNS records replicate alongside the rest of the directory. This site made the same argument a couple of weeks ago about on-prem Exchange: a Windows Server role that looks like it just handles one narrow function is frequently sitting on, or directly next to, the box holding the domain’s entire credential database. Unauthenticated SYSTEM-level code execution against the DNS service on a domain controller isn’t a DNS incident. It’s a starting point for exactly the kind of post-exploitation chain this site’s Impacket and BloodHound series have walked through in detail: credential dumping, Kerberoasting, and a path to Domain Admin, except the attacker didn’t need a single valid credential to get the first foothold.
The rest of this Patch Tuesday leaned the same direction. CVE-2026-62815, an unauthenticated RCE in Microsoft’s QUIC implementation (the transport underneath HTTP/3, running on an estimated 13.5 million sites per Netcraft-style tracking), and CVE-2026-62893, an unauthenticated RCE in Windows Deployment Services’ TFTP server reachable over UDP/69 with no login required at all, both shipped the same day. None of these three are confirmed exploited as of release, but all three share the same shape: no authentication, no user interaction, reachable straight off the network.
Who’s affected and what to actually do
Microsoft’s own affected-products list, per the CVE record, spans Windows 10 versions 1607 and 1809 alongside Windows Server 2012, 2012 R2, 2016, and 2019, with the full list continuing past what fits in a single record excerpt. Worth noting plainly: Windows Server 2012 and 2012 R2 are well past mainstream support, so a fix landing for those builds at all means they’re presumably still covered under Extended Security Updates. If you’re running DNS Server on anything that old, this is a good moment to confirm ESU enrollment is actually active rather than assumed.
The practical guidance is short. Patch DNS Server role hosts first in this month’s rollout, not on the normal maintenance-window cadence, the same “test and deploy quickly” language ZDI used. Confirm no DNS server, domain controller or otherwise, is directly reachable from the internet: DNS resolution for internal clients has no business being exposed publicly, and if a public-facing DNS service is genuinely required, it should be a dedicated, hardened, non-AD-integrated instance, not the same box holding your domain’s credentials. That’s the same “get management interfaces off the public internet” lesson from the FortiBleed post above, applied to a different vendor and a different protocol.
The bigger picture is worth sitting with for a second. This site covered the Linux kernel’s slow-motion retreat from unsafe C string handling a few months ago, part of an industry-wide, decade-long push toward memory-safe languages and safer string primitives specifically to kill off bug classes like CWE-121. CVE-2026-62878 is a reminder that the retreat is far from finished, and it isn’t just the kernel. A “good ol’ fashioned stack-based buffer overflow,” in Dustin Childs’ own words, still reaches CVSS 9.8 and wormable status in a codebase shipping security updates in 2026.