CVE-2026-70091 Overview
CVE-2026-70091 is a race condition vulnerability in Windows Domain Name System (DNS) that allows an unauthenticated attacker to trigger a denial of service over the network. The flaw stems from concurrent execution using a shared resource with improper synchronization, classified under [CWE-362]. Successful exploitation disrupts DNS resolution services, affecting dependent applications and clients relying on the impacted server. Microsoft published the advisory on 2026-09-08 through the Microsoft Security Response Center.
Critical Impact
Successful exploitation causes a denial of service in the Windows DNS role, disrupting name resolution for downstream clients and services that depend on the affected server.
Affected Products
- Windows DNS Server (see the Microsoft Security Update Guide CVE-2026-70091 for the authoritative list of affected builds)
- Windows Server installations running the DNS Server role
- Environments exposing DNS services to untrusted networks
Discovery Timeline
- 2026-09-08 - CVE-2026-70091 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-70091
Vulnerability Analysis
The vulnerability resides in the Windows DNS service and is triggered when multiple threads or requests access a shared resource without adequate synchronization. An attacker sends crafted DNS traffic that interleaves with legitimate processing, producing an inconsistent state within the service. The resulting condition causes the DNS service to fail, terminating name resolution for clients that depend on the affected server. The attacker does not require authentication or user interaction to reach the vulnerable code path.
Exploitation requires timing precision because the attacker must win a narrow race window inside the service. Repeated attempts across the network can succeed given sufficient traffic volume. The impact is limited to availability; the flaw does not expose data or permit code execution.
Root Cause
The root cause is improper synchronization when concurrent operations access a shared resource within the Windows DNS service [CWE-362]. Missing or incorrect locking primitives allow one thread to modify state while another reads or writes the same data, leading to a corrupted or unexpected state that crashes or hangs the service.
Attack Vector
The attack originates from the network and targets the Windows DNS listener directly. An unauthenticated attacker sends specifically timed DNS queries or updates to trigger the race. Because DNS servers commonly accept traffic from broad client populations, exposure is high in environments that publish DNS to untrusted or partially trusted networks. See the Microsoft Security Update Guide CVE-2026-70091 for vendor-authored exploitation context.
No verified public proof-of-concept code exists at the time of publication. The vulnerability mechanism is described in prose; refer to the vendor advisory for additional technical detail.
Detection Methods for CVE-2026-70091
Indicators of Compromise
- Unexpected termination or hang of the DNS Server service (Windows Service Control Manager events 7031, 7034, or 7036).
- Application or System event log entries from source DNS-Server-Service indicating abnormal shutdown or worker thread faults.
- Sudden loss of DNS name resolution for downstream clients coinciding with anomalous inbound query patterns.
Detection Strategies
- Alert on repeated restarts of the Windows DNS service within short intervals across domain controllers or dedicated DNS hosts.
- Baseline DNS query rates per source IP and flag sustained bursts or protocol anomalies targeting the DNS listener on UDP/TCP 53.
- Correlate DNS service crashes with concurrent inbound traffic spikes to identify probable exploitation attempts.
Monitoring Recommendations
- Forward Windows Event Log channels for DNS Server and System to a centralized SIEM for cross-host correlation.
- Enable DNS analytical and audit logging on Windows DNS Servers to capture query patterns preceding service failures.
- Monitor availability metrics for DNS resolution latency and success rates from synthetic probes on internal and external networks.
How to Mitigate CVE-2026-70091
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-70091 to all Windows Servers running the DNS role.
- Inventory internet-exposed DNS servers and prioritize patching for hosts reachable from untrusted networks.
- Verify redundancy across DNS servers so that a single service crash does not eliminate name resolution for critical workloads.
Patch Information
Microsoft has published a fix through the Microsoft Security Response Center. Consult the Microsoft Security Update Guide CVE-2026-70091 for the specific KB articles, affected Windows Server versions, and required update packages.
Workarounds
- Restrict inbound DNS traffic on UDP/TCP 53 to trusted networks using host-based firewalls or network access control lists where operationally feasible.
- Deploy rate limiting at network boundaries to reduce the volume of unsolicited queries reaching Windows DNS servers.
- Configure DNS server redundancy and automatic service recovery to reduce dwell time of a successful denial of service.
# Example: restrict inbound DNS to trusted subnets on Windows Server
New-NetFirewallRule -DisplayName "Restrict DNS UDP" -Direction Inbound -Protocol UDP -LocalPort 53 -RemoteAddress 10.0.0.0/8,192.168.0.0/16 -Action Allow
New-NetFirewallRule -DisplayName "Restrict DNS TCP" -Direction Inbound -Protocol TCP -LocalPort 53 -RemoteAddress 10.0.0.0/8,192.168.0.0/16 -Action Allow
# Configure DNS service to auto-restart after failure
sc.exe failure DNS reset= 86400 actions= restart/5000/restart/5000/restart/5000
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.