CVE-2026-72928— Windows DNS Server Remote Code Execution Vulnerability
Quick assessment
Affected
Microsoft Windows Server 2025
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Microsoft Windows DNS是美国Microsoft公司的一款域名系统服务器。 Microsoft Windows DNS存在资源管理错误漏洞，该漏洞源于Windows DNS存在释放后重用，可能导致授权攻击者通过网络执行代码。
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Microsoft | Windows Server 2025 | 10.0.26100.0< 10.0.26100.33438 |
affected |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0< 10.0.26100.33438 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-72928
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Windows DNS Server Remote Code Execution Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Use after free in Windows DNS allows an authorized attacker to execute code over a network.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Vulnerability Title
Microsoft Windows DNS 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microsoft Windows DNS是美国Microsoft公司的一款域名系统服务器。 Microsoft Windows DNS存在资源管理错误漏洞，该漏洞源于Windows DNS存在释放后重用，可能导致授权攻击者通过网络执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Microsoft | Windows Server 2025 | 10.0.26100.0 ~ 10.0.26100.33438 | - |
|
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 ~ 10.0.26100.33438 | - |
|
II. Public POCs for CVE-2026-72928
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-72928
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-72928 (1)
Same Patch Batch · Microsoft · 2026-09-08 · 966 CVEs total
| CVE-2026-83941 | 9.9 CRITICAL | Entra ID Elevation of Privilege Vulnerability |
| CVE-2026-78445 | 9.8 CRITICAL | Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability |
| CVE-2026-69463 | 9.8 CRITICAL | Windows NTFS Remote Code Execution Vulnerability |
| CVE-2026-73025 | 9.8 CRITICAL | Windows iSCSI Security Feature Bypass Vulnerability |
| CVE-2026-73010 | 9.8 CRITICAL | Microsoft Failover Cluster Remote Code Execution Vulnerability |
| CVE-2026-70296 | 9.8 CRITICAL | Windows Imaging Component Remote Code Execution Vulnerability |
| CVE-2026-69819 | 9.8 CRITICAL | RPC Runtime Library Remote Code Execution Vulnerability |
| CVE-2026-69715 | 9.8 CRITICAL | Windows Direct Show Remote Code Execution Vulnerability |
| CVE-2026-73009 | 9.8 CRITICAL | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
| CVE-2026-69590 | 9.8 CRITICAL | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2026-68839 | 9.8 CRITICAL | Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability |
| CVE-2026-69525 | 9.8 CRITICAL | Remote Desktop Services Remote Code Execution Vulnerability |
| CVE-2026-69768 | 9.8 CRITICAL | Windows RNDIS Remote Code Execution Vulnerability |
| CVE-2026-69491 | 9.8 CRITICAL | Microsoft DirectMusic Remote Code Execution Vulnerability |
| CVE-2026-69431 | 9.8 CRITICAL | Telnet Client Remote Code Execution Vulnerability |
| CVE-2026-72979 | 9.8 CRITICAL | Windows DHCP Server Remote Code Execution Vulnerability |
| CVE-2026-69824 | 9.8 CRITICAL | Microsoft Standard XPS Remote Code Execution Vulnerability |
| CVE-2026-69408 | 9.8 CRITICAL | Microsoft Windows Media Foundation Remote Code Execution Vulnerability |
| CVE-2026-69910 | 9.8 CRITICAL | Windows Hyper-V Remote Code Execution Vulnerability |
| CVE-2026-78509 | 9.8 CRITICAL | Microsoft Office Outlook Remote Code Execution Vulnerability |
Showing top 20 of 966 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Windows Server 2025
-
CVE-2026-49169
Windows DNS Server Remote Code Execution Vulnerability -
CVE-2026-34332
Windows Kernel-Mode Driver Remote Code Execution Vulnerabili -
CVE-2026-34350
Windows Storport Miniport Driver Denial of Service Vulnerabi -
CVE-2026-20830
Capability Access Management Service (camsvc) Elevation of P -
CVE-2025-53779
Windows Kerberos Elevation of Privilege Vulnerability
Same vendor: Microsoft
-
CVE-2026-85892
Microsoft Edge (Chromium-based) Elevation of Privilege Vulne -
CVE-2026-85921
Windows Secure Kernel Mode Elevation of Privilege Vulnerabil -
CVE-2026-77490
Microsoft Edge (Chromium-based) Spoofing Vulnerability -
CVE-2026-70341
Microsoft Edge (Chromium-based) Remote Code Execution Vulner -
CVE-2026-66307
Skype for Business and Lync Denial of Service Vulnerability
Same weakness: CWE-416
-
CVE-2026-90852
luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdC -
CVE-2026-90827
GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use afte -
CVE-2026-90825
GPAC MP4Box base_scenegraph.c gf_node_unregister use after f -
CVE-2026-16147
it82xx2 USB device controller submits incomplete OUT transfe -
CVE-2026-15924
Use-after-free / double-free from unsynchronized concurrent
V. Comments for CVE-2026-72928
No comments yet