CVE-2026-70167

Summary

A type confusion vulnerability in Microsoft's DNS Server allows authenticated attackers to execute arbitrary code remotely. This occurs when the DNS server incorrectly handles resource types, leading to potential remote code execution with high severity.

Exploitability

Exploitation requires an authenticated user with access to the DNS server, making it moderately difficult but possible given sufficient privileges, with no additional preconditions beyond network access and authentication credentials.

Blast radius

If exploited, this vulnerability could allow attackers to execute code on DNS servers running Windows Server 2022 or 2025, potentially leading to full domain compromise and lateral movement throughout the network.

Detection

Monitor for unusual DNS query patterns or unexpected resource type handling in DNS server logs, particularly around zone transfers or dynamic updates that might indicate type confusion exploitation attempts.

Prioritized remediation

Apply the latest security updates for Windows Server 2022 and Windows Server 2025, specifically targeting the DNS Server component with the fixes included in the March 2026 security updates.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.