CVE-2026-65795 Overview
CVE-2026-65795 is an elevation of privilege vulnerability in Windows DNS. An authorized attacker with high privileges on a local system can exploit the flaw to elevate privileges further. Microsoft published the advisory on August 11, 2026, and the entry was updated on August 12, 2026.
The vulnerability carries a CVSS 3.1 base score of 6.7 with a local attack vector. Successful exploitation impacts confidentiality, integrity, and availability. The current EPSS score of 0.256% places the vulnerability in the 17.301 percentile, indicating low near-term exploitation probability.
Critical Impact
A local attacker with existing high privileges can leverage the Windows DNS component to achieve full elevation of privilege on the affected host.
Affected Products
- Microsoft Windows (Windows DNS component)
- Refer to the Microsoft Security Update Guide for the complete list of affected builds
- Server roles running the Windows DNS service
Discovery Timeline
- 2026-08-11 - CVE-2026-65795 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-65795
Vulnerability Analysis
CVE-2026-65795 is an elevation of privilege issue affecting the Windows DNS component. The advisory from Microsoft does not associate the flaw with a specific CWE classification. Successful exploitation grants an attacker elevated privileges on the affected host, resulting in high confidentiality, integrity, and availability impact.
The vulnerability requires local access and existing high privileges on the target. No user interaction is needed, and the attack complexity is low. This profile indicates a post-compromise privilege escalation primitive rather than an initial access vector.
Microsoft has not published detailed root cause analysis or proof-of-concept code. No public exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause has not been disclosed by Microsoft. The advisory identifies the vulnerable component as Windows DNS but does not provide a CWE mapping or implementation details. Review the Microsoft Security Update Guide entry for authoritative technical context.
Attack Vector
An attacker must first obtain authenticated local access with high privileges on a system running the Windows DNS service. From that foothold, the attacker interacts with the DNS component to elevate to a higher privilege context, typically SYSTEM. The vulnerability cannot be exploited remotely and does not require user interaction.
No verified exploitation code is available. Refer to the vendor advisory for further technical detail.
Detection Methods for CVE-2026-65795
Indicators of Compromise
- No public indicators of compromise have been released for CVE-2026-65795.
- Monitor Windows DNS service processes (dns.exe) for unusual child processes or token manipulation.
- Track unexpected privilege escalation events on servers running the DNS role.
Detection Strategies
- Correlate Windows Security Event Log entries for privilege assignment (Event ID 4672) originating from DNS-related process contexts.
- Baseline normal DNS service behavior and alert on deviations such as new module loads or unexpected API calls.
- Deploy behavioral endpoint monitoring capable of detecting local privilege escalation techniques mapped to MITRE ATT&CK T1068.
Monitoring Recommendations
- Ingest DNS server and Windows security telemetry into a centralized SIEM for correlation across authentication and process events.
- Alert on new service creations, scheduled tasks, or account modifications performed by the DNS service account.
- Review privileged account activity on DNS servers on a recurring cadence and validate all administrative sessions.
How to Mitigate CVE-2026-65795
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory to all Windows systems running the DNS role.
- Inventory hosts running Windows DNS and prioritize domain controllers and internet-facing resolvers.
- Restrict local logon rights and administrative access to DNS servers to reduce the attacker population able to reach the flaw.
Patch Information
Microsoft has released a security update addressing CVE-2026-65795. Consult the Microsoft Security Update Guide for the specific KB article, affected versions, and installation guidance. Deploy the patch through Windows Update, WSUS, or your standard patch management process.
Workarounds
- No official workarounds have been published by Microsoft. Patching is the recommended remediation.
- Enforce least privilege on DNS servers so fewer accounts hold the high privileges required to exploit the flaw.
- Segment DNS infrastructure from general-purpose workloads to limit lateral movement following a successful escalation.
# Verify installed updates on a Windows DNS server
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Confirm the DNS service is running and review its account context
Get-Service -Name DNS | Format-List *
Get-CimInstance Win32_Service -Filter "Name='DNS'" | Select-Object Name, StartName, State
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
