Windows DNS Server Stack Buffer Overflow Remote Code Execution
Stack-based buffer overflow in Windows DNS Server enables unauthenticated remote code execution. Affects Windows Server 2012 through 2025.
- Vendor
- Microsoft
- Product
- Windows DNS Server (Server 2012–2025)
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.0%
- Status
- patched
- Published
Is CVE-2026-62878 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-62878 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.0% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-62878 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-62878 is a stack-based buffer overflow in the Windows DNS Server service, enabling remote code execution without authentication. The vulnerability spans a wide range of Windows Server versions — 2012 through 2025 — putting a large installed base at risk. DNS servers are frequently network-accessible, and in many environments internet-facing, making this a high-exposure target.
CVSS 9.8 (Critical). Not yet observed in active exploitation as of the August 2026 Patch Tuesday release, but the combination of wide version coverage, network reachability, and no authentication requirement makes it an attractive target for threat actors.
Affected products: Windows DNS Server on Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.
Mitigation: Apply the August 2026 Patch Tuesday cumulative update. If patching is delayed, restrict DNS server access to trusted networks at the firewall layer; do not expose Windows DNS Server directly to the internet.
Priority: High — CVSS 9.8, wide version coverage, DNS servers are commonly network-reachable.
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | [ MEDIUM ] | 6.5 | 1.6% | |
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 9.8% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 2.7% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 9.9% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 7.1% |
