CVE-2026-49174: Windows 10 1809 Auth Bypass Vulnerability

CVE-2026-49174 Overview

CVE-2026-49174 is a missing authentication vulnerability in the Microsoft Windows DNS component. The flaw allows an authorized local attacker to tamper with DNS data or configuration because a critical function fails to verify the caller's identity. The weakness is tracked under CWE-306: Missing Authentication for Critical Function.

Microsoft published the advisory on 2026-07-14, and the issue affects supported client and server Windows editions, including Windows Server 2019, 2022, and 2025. Because the impact is scoped to tampering with high integrity impact, successful exploitation can alter DNS records or service behavior without triggering authentication checks.

Critical Impact
An authenticated local user can tamper with Windows DNS state, potentially redirecting name resolution or modifying zone data without proper authorization.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2)
Microsoft Windows 11 (24H2, 25H2, 26H1)
Microsoft Windows Server 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-49174 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-49174

Vulnerability Analysis

The vulnerability resides in the Windows DNS service, which resolves names for both client and server roles. A critical function within the DNS component performs sensitive operations without verifying that the caller holds the required privileges. An authorized local user can invoke that function directly and modify DNS state.

The issue is classified as [CWE-306], missing authentication for a critical function. Confidentiality impact is limited, but integrity impact is high. Availability is not affected, meaning the DNS service continues to run even after tampering. The EPSS probability is 0.202%, reflecting low observed exploitation likelihood at publication.

Root Cause

The root cause is an authentication gap in a privileged DNS code path. The function assumes the caller is trusted based on execution context rather than validating identity or access rights. Any local principal that can reach the interface can therefore perform actions reserved for administrators.

Attack Vector

Exploitation requires local access and low privileges. No user interaction is needed. An attacker with a valid local session invokes the unauthenticated DNS function to alter records, cached entries, or service configuration. Tampered DNS responses can then influence downstream applications and users that rely on the affected server for name resolution.

No public proof-of-concept or exploit code is available at the time of publication. Refer to the Microsoft Security Update for CVE-2026-49174 for vendor technical detail.

Detection Methods for CVE-2026-49174

Indicators of Compromise

Unexpected modifications to DNS zone files, records, or forwarders on Windows DNS servers.
DNS Server event log entries showing configuration or zone changes outside of change-management windows.
Local process activity from non-administrative accounts interacting with dns.exe or DNS RPC interfaces.

Detection Strategies

Monitor Windows Event Log channels DNS Server and Microsoft-Windows-DNSServer/Audit for record creation, deletion, and zone updates.
Baseline authorized DNS administrators and alert on changes initiated by any other local account.
Correlate local logon events (Event ID 4624 type 2/10) with subsequent DNS management activity to identify unauthorized callers.

Monitoring Recommendations

Enable DNS audit logging on all Windows Server 2019, 2022, and 2025 DNS role hosts.
Forward DNS audit events to a centralized SIEM or data lake for retention and correlation.
Track integrity of zone data using periodic exports and hash comparison against a known-good baseline.

How to Mitigate CVE-2026-49174

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-49174 to all affected Windows client and server builds.
Restrict interactive and remote-desktop logon rights on DNS servers to a minimal set of administrators.
Review DNS zone data and recent configuration changes for unauthorized modifications.

Patch Information

Microsoft has released fixes through the standard Windows update channel. See the Microsoft Security Update for CVE-2026-49174 for the specific KB articles that correspond to each affected build, including Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025.

Workarounds

Limit local logon to Windows DNS servers using Group Policy User Rights Assignment to reduce the pool of accounts that can reach the vulnerable function.
Separate DNS server roles from general-purpose or multi-user hosts to minimize local attack surface.
Enable DNS audit logging and alert on any configuration change until patches are deployed.

bash

# Configuration example: verify patch level and DNS audit configuration on Windows Server
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
wevtutil gl "Microsoft-Windows-DNSServer/Audit"
wevtutil sl "Microsoft-Windows-DNSServer/Audit" /e:true