CVE-2026-70087 Overview
CVE-2026-70087 is an incorrect authorization vulnerability [CWE-863] in Microsoft DNS Server. An authorized attacker with local access can bypass a security feature on the affected host. The flaw affects the integrity of DNS Server operations without impacting confidentiality or availability. Microsoft published the advisory on October 13, 2026.
The vulnerability requires low privileges and no user interaction. Exploitation produces a high integrity impact, meaning an attacker can modify data or configurations that the security control was designed to protect. No public proof-of-concept code or active exploitation has been reported.
Critical Impact
An authenticated local user can bypass a DNS Server security feature and modify protected DNS data or configuration state.
Affected Products
- Microsoft DNS Server (refer to the Microsoft advisory for the complete list of affected Windows Server builds)
Discovery Timeline
- 2026-10-13 - CVE-2026-70087 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-70087
Vulnerability Analysis
The vulnerability resides in the Microsoft DNS Server service and is classified as incorrect authorization [CWE-863]. The DNS Server performs an authorization check that does not correctly validate the privileges required to perform a protected operation. An authenticated local user can leverage this gap to invoke functionality that should otherwise be restricted.
The scope is unchanged, meaning exploitation affects resources managed by the vulnerable DNS Server component. The attack targets integrity only; the attacker can alter protected state but cannot directly disclose confidential data or crash the service through this flaw.
Root Cause
The root cause is an improper authorization decision inside DNS Server code paths that gate security-sensitive operations. The service grants access to a function or resource without verifying that the calling principal holds the required rights. This matches the CWE-863 pattern where an access control check exists but applies the wrong policy.
Attack Vector
The attack vector is local, so the attacker must have an authenticated session on the host running DNS Server. No user interaction is required. An attacker with a low-privilege account on the server can issue the affected request path and bypass the intended security feature.
No exploitation code is available in public repositories at the time of publication. Microsoft has not reported in-the-wild exploitation. See the Microsoft CVE-2026-70087 Advisory for product-specific technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-70087
Indicators of Compromise
- Unexpected changes to DNS zone data, resource records, or server-level configuration performed by non-administrative accounts.
- DNS Server event log entries showing configuration or zone modifications originating from local, low-privilege sessions.
- Local logon events on DNS Server hosts followed by DNS management API or RPC activity from unusual users.
Detection Strategies
- Enable DNS Server audit logging and analytical event channels to capture zone, record, and policy modifications with the invoking security principal.
- Correlate Windows Security event IDs for logon (4624) and privilege use with DNS management operations from the same session.
- Alert on calls to the DNS management RPC interface or dnscmd.exe executed by accounts outside the DNS administrator group.
Monitoring Recommendations
- Baseline normal administrative activity on DNS Server hosts, then flag deviations by user, time, and operation type.
- Forward DNS Server, Security, and System event logs to a centralized analytics platform for retention and correlation.
- Monitor group membership changes for DnsAdmins and local Administrators on servers hosting the DNS role.
How to Mitigate CVE-2026-70087
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-70087 Advisory to all affected Windows Server hosts running the DNS role.
- Inventory servers running the DNS Server role and prioritize patching for domain controllers and internet-adjacent resolvers.
- Review local accounts and interactive logon rights on DNS Server hosts, removing any that are not required for operations.
Patch Information
Microsoft released a patch addressed in the vendor advisory. Administrators should consult the Microsoft CVE-2026-70087 Advisory for the specific KB article, affected builds, and update packages applicable to their environment.
Workarounds
- Restrict interactive and remote local logon on DNS Server hosts to a minimal set of administrative accounts until the patch is applied.
- Enforce tiered administration so that DNS Server systems are managed only from privileged access workstations.
- Audit and reduce membership in the DnsAdmins group and local Administrators group on affected servers.
# Example: list local group membership on a DNS Server host
net localgroup Administrators
net localgroup DnsAdmins
# Example: verify installed updates after patching
wmic qfe list brief /format:table
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
