- The Mess: Microsoft patched CVE-2026-69730, a critical Windows DNS Server remote-code-execution flaw with a CVSS score of 9.8. ZDI calls it “SigRed’s spiritual successor.”
- The Damage: An unauthenticated attacker can hit a vulnerable DNS server over the network and potentially execute arbitrary code.
- The Fix: Patch Windows DNS servers immediately and treat internet-exposed DNS infrastructure as hostile until updated.
DNS is supposed to be boring infrastructure. That is exactly why attackers love it.
CVE-2026-69730 affects the Windows DNS Server role and carries the maximum CVSS 9.8 rating. The vulnerability is classified as remote code execution and requires neither authentication nor user interaction.
That combination is ugly: network reachable + no credentials + code execution.
The comparison with SigRed (CVE-2020-1350) is not accidental. ZDI specifically describes CVE-2026-69730 as SigRed’s spiritual successor. SigRed was one of the nastiest Windows DNS flaws of recent years because DNS servers often sit directly inside the trust boundary of Active Directory environments.
And there is another problem.
The September 2026 Microsoft security release contains several additional Windows DNS vulnerabilities, including CVE-2026-69858, CVE-2026-69813, CVE-2026-69827 and CVE-2026-77505. Most are rated lower than CVE-2026-69730, but the concentration of bugs in the same attack surface is a warning by itself.
For organizations running Windows Server as DNS infrastructure, this is not a “patch it during the next maintenance window” situation.
A compromised DNS server can become much more than a DNS problem. In many Windows environments, DNS and Active Directory are tightly coupled. Attackers already inside a network can abuse DNS infrastructure for discovery, traffic manipulation and lateral movement. A remotely exploitable RCE gives them a much cleaner starting point.
The practical response is simple:
Patch the Windows Server hosts running the DNS role.
Then check whether those servers are reachable from untrusted networks. If they are, reduce exposure immediately. DNS should not be another accidentally exposed Windows service sitting on the public Internet.
Bugstoday Opinion
A 9.8 unauthenticated RCE in Windows DNS is exactly the kind of vulnerability administrators should fear before an exploit appears.
The dangerous part is not just the bug.
It is where the bug lives.
DNS servers are infrastructure. Compromise the infrastructure and the rest of the network gets considerably easier to attack.
Microsoft just patched another reason to keep Windows DNS extremely boring, extremely restricted and extremely up to date.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Microsoft Security Response Center
Zero Day Initiative
