CVE-2026-62878: Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-62878 is a remote code execution vulnerability in Windows DNS Server, rated Critical by Microsoft, with a CVSS 3.1 base score of 9.8 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.97% probability of exploitation activity in the next 30 days, higher than 62% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 8 security updates (KB5120238, KB5120242, KB5120229, KB5120233 and more). It affects 12 products in 2 product families (Windows, ESU).

Key facts

CVE ID: CVE-2026-62878
Severity: Critical CVSS 9.8
Microsoft severity: Critical
Impact: Remote Code Execution
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
Weakness: CWE-121
EPSS: 0.97% (percentile 62%)
CISA KEV: Not listed
Released: 11 August 2026
Last updated: 8 September 2026
Patch Tuesday: August 2026 Patch Tuesday
Product families: Windows, ESU

From the August 2026 Patch Tuesday briefing

Windows DNS Server Remote Code Execution

This targets Windows DNS Server, a foundational service that is often reachable across large portions of the enterprise network. An attacker who can reach the DNS service could potentially execute code on the DNS server, turning core infrastructure into an attacker-controlled asset. This is a Critical Windows DNS Server RCE with CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, tied to CWE-121 (Stack-based Buffer Overflow). The prerequisites are minimal: an attacker only needs network reachability to a DNS server, no authentication, no user interaction. That makes this particularly dangerous in enterprises where DNS servers are reachable from broad internal segments, branch networks, or (in misconfigurations) from the internet.

From the briefing, written by an AI model from PatchaPalooza's data.

CVSS score and vector

Microsoft scores CVE-2026-62878 at 9.8 (temporal 8.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Metric	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required..

Affected products (12)

Windows

Product	Security update	Type	Fixed build	Restart
Windows Server 2019	KB5120238	Security Update	10.0.17763.9121	Yes
Windows Server 2019 (Server Core installation)	KB5120238	Security Update	10.0.17763.9121	Yes
Windows Server 2022	KB5120242 KB5120229	Security Update Security Hotpatch Update	10.0.20348.5499 10.0.20348.5440	Yes Yes
Windows Server 2022 (Server Core installation)	KB5120242 KB5120229	Security Update Security Hotpatch Update	10.0.20348.5499 10.0.20348.5440	Yes Yes
Windows Server 2025 (Server Core installation)	KB5120233 KB5120228	Security Update Security Hotpatch Update	10.0.26100.33296 10.0.26100.33222	Yes Yes
Windows Server 2025	KB5120233 KB5120228	Security Update Security Hotpatch Update	10.0.26100.33296 10.0.26100.33222	Yes Yes
Windows Server 2016	KB5120418	Security Update	10.0.14393.9418	Yes
Windows Server 2016 (Server Core installation)	KB5120418	Security Update	10.0.14393.9418	Yes

ESU

Product	Security update	Type	Fixed build	Restart
Windows Server 2012	KB5120386	Monthly Rollup	6.2.9200.26280	Yes
Windows Server 2012 (Server Core installation)	KB5120386	Monthly Rollup	6.2.9200.26280	Yes
Windows Server 2012 R2	KB5120385	Monthly Rollup	6.3.9600.23338	Yes
Windows Server 2012 R2 (Server Core installation)	KB5120385	Monthly Rollup	6.3.9600.23338	Yes

Security updates (8)

KB5120238 (Security Update)
KB5120242 (Security Update)
KB5120229 (Security Hotpatch Update)
KB5120233 (Security Update)
KB5120228 (Security Hotpatch Update)
KB5120418 (Security Update)
KB5120386 (Monthly Rollup)
KB5120385 (Monthly Rollup)

Exploitation and detection

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (1)

nmlz/CVE-2026-62878 · 1 stars

NIST NVD data

NVD status: Analyzed
NVD CVSS: 9.8 (CRITICAL)
NVD weakness: CWE-121
Published to NVD: 11 August 2026
NVD last modified: 17 August 2026

Affected configurations (CPE)

Product	Vulnerable versions
windows 10 1607 (x64)	before 10.0.14393.9418
windows 10 1607 (x86)	before 10.0.14393.9418
windows 10 1809 (x64)	before 10.0.17763.9121
windows 10 1809 (x86)	before 10.0.17763.9121
windows server 2012	all listed versions
windows server 2012 r2	all listed versions
windows server 2016	before 10.0.14393.9418
windows server 2019	before 10.0.17763.9121
windows server 2022	before 10.0.20348.5440
windows server 2025	before 10.0.26100.33222

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62878 (Vendor Advisory, Patch)

Revision history

Version	Date	Description
1.0	11 August 2026	Information published.
1.1	8 September 2026	Updated software table to remove clients versions because this vulnerability only impacts Windows Servers. This is an informational change only.