# CVE-2026-69730: Microsoft Windows DNS use-after-free remote code execution

Source: https://junglewise.ai/threats/cve-2026-69730-microsoft-windows-dns-use-after-free-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-69730 · Severity: critical · CVSS 9.8 · Published 2026-09-08

Windows DNS Server processes domain name resolution requests from across the network. A use-after-free vulnerability allows an unauthenticated attacker to send specially crafted DNS queries that could result in remote code execution, potentially compromising the entire DNS infrastructure and enabling network-wide attacks.

Technologies: [Microsoft Windows DNS Server](https://junglewise.ai/threats/technologies/windows-dns). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-69730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69730 being exploited in the wild.

**How severe is CVE-2026-69730?** Critical severity, with a CVSS score of 9.8, published 8 September 2026.

**Which products and versions are affected?** Microsoft Windows DNS Server.

**Is there a fix for CVE-2026-69730?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-69730 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-69730?** Check whether you run Microsoft Windows DNS Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in Windows DNS Server's request handling logic. The vulnerability is triggered by a network-reachable attacker sending crafted DNS queries without requiring authentication or user interaction. Successful exploitation allows arbitrary code execution in the context of the DNS service, potentially leading to full system compromise. A patch is available from Microsoft.

## Affected products

- Microsoft Windows DNS Server

## Timeline

- 2026-09-08: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69730](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69730)

## Related threats

- [Microsoft Windows DNS out-of-bounds read](https://junglewise.ai/threats/cve-2026-97006-out-of-bounds-read-in-windows-dns-allows-an-authorized-attacker)
- [Windows DNS Server use-after-free remote code execution](https://junglewise.ai/threats/cve-2026-96177-use-after-free-in-dns-server-allows-an-unauthorized-attacker-to)
- [Microsoft Windows DNS Server use-after-free denial of service](https://junglewise.ai/threats/cve-2026-96017-use-after-free-in-dns-server-allows-an-authorized-attacker-to)
- [Microsoft Windows DNS Server improper input validation spoofing](https://junglewise.ai/threats/cve-2026-119905-improper-input-validation-in-windows-dns-allows-an-authorized)
- [Windows DNS integer overflow in message parsing](https://junglewise.ai/threats/cve-2026-105579-integer-overflow-or-wraparound-in-windows-dns-allows-an)