CVE-2026-72948: Windows DNS Path Traversal Vulnerability

CVE-2026-72948 Overview

CVE-2026-72948 is a relative path traversal vulnerability [CWE-23] affecting the Windows Domain Name System (DNS) component. An authorized attacker with high privileges on the local system can abuse improper path handling to elevate privileges. Successful exploitation compromises confidentiality, integrity, and availability of the affected host.

Microsoft assigned this issue a CVSS 3.1 base score of 6.7 with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability requires local access and existing privileges, which reduces opportunistic exploitation. However, it remains relevant for post-compromise scenarios where attackers seek to escalate from an administrative service context to full system control.

Critical Impact
Local privilege escalation on Windows DNS servers, enabling attackers to move from a privileged foothold to full system compromise.

Affected Products

Microsoft Windows (DNS component)
Windows Server installations running the DNS role
Consult the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-72948 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72948

Vulnerability Analysis

The vulnerability resides in how the Windows DNS component resolves file or resource paths supplied to it during privileged operations. Because relative path sequences such as ..\ are not properly normalized or validated, an authorized attacker can direct file operations outside the intended directory. When the DNS service runs under a high-privilege account, this misdirected file access can be leveraged to overwrite, replace, or read sensitive resources controlled by the operating system.

Exploitation requires the attacker to already hold high privileges on the target host, which narrows the pool of adversaries but aligns with post-exploitation and insider threat scenarios. Refer to the Microsoft Security Update Guide for vendor-specific technical context.

Root Cause

The root cause is insufficient sanitization of path inputs processed by the DNS service, classified as [CWE-23] Relative Path Traversal. The service accepts path components that traverse parent directories without enforcing canonicalization or restricting access to a designated base directory.

Attack Vector

The attack vector is local. An authorized attacker interacts with the DNS service on the target machine and supplies crafted path input containing traversal sequences. No user interaction is required. The DNS service then performs file operations at its elevated privilege level in an attacker-controlled location, producing privilege escalation.

No public proof-of-concept exploit code has been published for CVE-2026-72948 at the time of writing.

Detection Methods for CVE-2026-72948

Indicators of Compromise

Unexpected file creation, modification, or replacement in directories reachable from the DNS service working paths.
DNS service process (dns.exe) accessing files outside standard configuration and zone directories.
New or modified files under system directories whose owner or timestamp aligns with DNS service activity.

Detection Strategies

Monitor file system activity attributed to the DNS service for path strings containing ..\ or ../ sequences.
Correlate privileged process file writes with subsequent privilege escalation behaviors such as new service creation or scheduled task registration.
Baseline expected file paths accessed by dns.exe and alert on deviations from that baseline.

Monitoring Recommendations

Enable Windows object access auditing on DNS configuration and zone directories, and forward events to a central analytics platform.
Track Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) for anomalous activity by dns.exe and its child processes.
Review DNS server event logs for configuration changes that do not correlate with authorized administrative activity.

How to Mitigate CVE-2026-72948

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as testing permits.
Inventory all Windows Server hosts running the DNS role and prioritize patching for domain controllers and internet-facing resolvers.
Audit accounts with high privileges on DNS servers and revoke access that is not operationally required.

Patch Information

Microsoft addressed CVE-2026-72948 through its Patch Tuesday servicing channel. Consult the Microsoft Security Update Guide for the specific KB article and update package that applies to each affected Windows Server build. Deploy the update through Windows Server Update Services (WSUS), Microsoft Configuration Manager, or an equivalent patch management workflow.

Workarounds

Restrict administrative access to DNS servers using tiered administration and just-in-time privilege elevation.
Enforce least privilege for accounts that manage DNS zones and configuration files.
Where feasible, isolate DNS servers on management networks with strict access control lists until patches are applied.

bash

# Configuration example: verify DNS service patch level on Windows Server
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20
Get-Service -Name DNS | Format-List Name, Status, StartType