CVE-2026-103560 Overview
CVE-2026-103560 is an improper authorization vulnerability in Microsoft DNS Server. An authorized attacker with local access can tamper with DNS Server data due to missing authorization checks [CWE-862]. The flaw does not expose confidential data or disrupt availability, but it allows unauthorized modification of DNS Server state.
Microsoft published the advisory on October 13, 2026. The vulnerability requires local access and low privileges, and no user interaction is needed to exploit it. Public exploitation has not been reported, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
An authenticated local attacker can tamper with DNS Server configuration or records, potentially redirecting name resolution or corrupting zone data on affected hosts.
Affected Products
- Microsoft DNS Server (specific product builds listed in the Microsoft Security Update Guide)
- Windows Server roles hosting the DNS Server service
- Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
Discovery Timeline
- 2026-10-13 - CVE-2026-103560 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-103560
Vulnerability Analysis
The vulnerability stems from missing authorization checks in the Microsoft DNS Server component. An attacker who already holds a low-privilege account on the host can invoke DNS Server operations that should be restricted to higher-privileged roles. The result is an integrity impact: the attacker can modify DNS data or configuration without legitimate authorization.
Because the attack vector is local and no user interaction is required, exploitation hinges on prior access to the DNS Server host. The vulnerability does not grant code execution or information disclosure on its own. Instead, it allows tampering that can degrade trust in name resolution and support follow-on attacks such as internal redirection or man-in-the-middle positioning.
The EPSS probability of exploitation is low, consistent with the local attack prerequisite and the absence of public proof-of-concept code.
Root Cause
The root cause is classified as Missing Authorization [CWE-862]. A code path in the DNS Server service accepts requests from authenticated local principals without verifying that the caller holds the required role or permission for the requested action. Microsoft has not published low-level technical details beyond the advisory summary.
Attack Vector
Exploitation requires the attacker to authenticate to the DNS Server host with a low-privilege account. The attacker then issues a request to the vulnerable interface and modifies DNS Server state that should be protected. See the Microsoft Security Update Guide for Microsoft's technical description.
No verified exploit code is publicly available at this time. Readers should rely on the vendor advisory for precise exploitation preconditions.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-103560
Indicators of Compromise
- Unexpected modifications to DNS zone files, resource records, or server-level configuration on Windows DNS Servers.
- DNS Server event log entries recording administrative changes initiated by non-administrative accounts.
- Creation, deletion, or modification of DNS records that do not correspond to a change-management ticket.
Detection Strategies
- Audit Windows Event Logs for Microsoft-Windows-DNSServer/Audit events, specifically zone and record change events, and correlate the initiating account against expected DNS administrator identities.
- Monitor process execution of dnscmd.exe, Add-DnsServerResourceRecord, and other DNS management cmdlets executed by non-administrator accounts.
- Baseline DNS zone contents and alert on drift between snapshots.
Monitoring Recommendations
- Forward DNS Server audit logs to a centralized SIEM for correlation with authentication and privilege-use events.
- Alert on local logons to DNS Server hosts by accounts outside the DNS administration group.
- Track changes to the DNS Server registry hive HKLM\SYSTEM\CurrentControlSet\Services\DNS for unauthorized reconfiguration.
How to Mitigate CVE-2026-103560
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-103560 on all Windows Servers running the DNS Server role.
- Review and reduce the set of accounts with interactive or remote logon rights to DNS Server hosts.
- Audit DNS zone data and configuration for unexpected modifications prior to patching.
Patch Information
Microsoft has released a security update that addresses the missing authorization check in the DNS Server service. Administrators should consult the Microsoft Security Update Guide for the specific KB numbers that apply to each supported Windows Server version and install them through Windows Update, WSUS, or the Microsoft Update Catalog.
Workarounds
- Restrict local and remote interactive logon on DNS Server hosts to members of the DNS administrator group only.
- Enable DNS Server audit logging and ship the logs off-host to prevent tampering by a local attacker.
- Isolate DNS Server roles onto dedicated hosts to limit the pool of accounts that can authenticate locally and reach the vulnerable code path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
