CVE-2026-70085: DNS Server Authorization Bypass Vulnerability

CVE-2026-70085 Overview

CVE-2026-70085 is a missing authorization vulnerability in Microsoft DNS Server. An authorized attacker with local access can tamper with DNS Server data because the service fails to enforce required authorization checks. The weakness is categorized as [CWE-862] Missing Authorization.

Successful exploitation does not disclose information or disrupt availability, but it can modify DNS data integrity. Because DNS underpins name resolution for Active Directory and application services, unauthorized modifications can cascade into broader operational and security impacts across dependent systems.

Critical Impact
An authenticated local attacker can tamper with DNS Server state, undermining the integrity of name resolution without triggering availability or confidentiality indicators.

Affected Products

Microsoft DNS Server (see the Microsoft Security Update Guide for affected builds)

Discovery Timeline

2026-10-13 - CVE-2026-70085 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-70085

Vulnerability Analysis

The vulnerability stems from an authorization gap inside the Microsoft DNS Server component. The service accepts a local action from an authenticated user without validating whether the caller holds the required privilege to perform it. This allows an unprivileged but authenticated user to modify DNS Server resources that should be restricted to administrators.

The impact profile is integrity-only. The vulnerability does not expose record contents and does not crash the service. Instead, it enables unauthorized modification of DNS state, which can be weaponized to redirect traffic, poison cached records, or stage follow-on attacks against systems that trust DNS responses.

Exploitation requires local access and valid credentials on the host running the DNS Server role, which limits remote attack surface but remains relevant on multi-tenant servers and in post-compromise scenarios.

Root Cause

The root cause is [CWE-862] Missing Authorization. A code path handling a DNS Server operation does not verify that the invoking principal is authorized to perform that operation. Authorization decisions were likely assumed to be enforced upstream or by the caller's token membership, which the code does not independently validate.

Attack Vector

The attack vector is local and requires low privileges with no user interaction. An attacker who has shell or logon access to the DNS Server host invokes the affected interface and submits a tampering request. Because the service skips the authorization check, the request executes as if issued by a privileged caller.

No public proof-of-concept exploit code is available at the time of publication. Technical specifics are limited to the vendor advisory in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-70085

Indicators of Compromise

Unexpected modifications to DNS zone data, resource records, or server configuration not tied to a change ticket.
DNS Server event log entries showing configuration changes initiated by non-administrative accounts.
New or altered DNS records that redirect traffic for internal services, Active Directory SRV records, or update endpoints.

Detection Strategies

Enable DNS Server audit logging and forward events to a centralized analytics platform for correlation with account privilege context.
Baseline authorized administrators of the DNS role and alert on any zone or record modification sourced from accounts outside that baseline.
Correlate interactive or remote logon events on DNS Server hosts with subsequent DNS configuration changes made by the same session.

Monitoring Recommendations

Monitor Windows Event IDs related to DNS zone updates and management plane operations on servers hosting the DNS role.
Track changes to the HKLM\SYSTEM\CurrentControlSet\Services\DNS registry hive and DNS zone files for out-of-band edits.
Alert on local logons to DNS Server hosts by non-administrative accounts, which should be rare in production environments.

How to Mitigate CVE-2026-70085

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all hosts running the DNS Server role.
Inventory servers running the DNS Server role and prioritize patching for Active Directory integrated DNS servers and internet-facing resolvers.
Review and tighten local logon rights on DNS Server hosts so that only administrators can authenticate interactively.

Patch Information

Microsoft has issued guidance and updates through the Microsoft Security Update Guide. Administrators should consult the vendor advisory at Microsoft Security Update Guide for build-specific KB identifiers and deployment steps.

Workarounds

Remove unnecessary local user accounts and restrict Allow log on locally on DNS Server hosts to administrators only.
Isolate the DNS Server role on dedicated hosts rather than co-locating it with general-purpose or multi-user workloads.
Enforce just-in-time administration and monitor DNS management operations until patches are deployed.

bash

# Configuration example: restrict local logon on DNS servers (run on domain controller)
# Grant Allow log on locally only to Administrators via Group Policy
# Computer Configuration > Policies > Windows Settings > Security Settings >
#   Local Policies > User Rights Assignment > Allow log on locally
#
# Audit DNS Server operations via PowerShell
Set-DnsServerDiagnostics -EnableLoggingForServerStartStopEvent $true `
                         -EnableLoggingForZoneLoadingEvent $true `
                         -EnableLoggingForZoneDataWriteEvent $true `
                         -EnableLogFileRollover $true