# CVE-2026-69813: Microsoft Windows DNS use-after-free remote code execution

Source: https://junglewise.ai/threats/cve-2026-69813-microsoft-windows-dns-use-after-free-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-69813 · Severity: high · CVSS 8.1 · Published 2026-09-08

Windows DNS Server contains a use-after-free vulnerability that allows an unauthenticated attacker to execute arbitrary code remotely. This affects the DNS service which is critical infrastructure in most Windows network environments. Exploitation could lead to complete server compromise and lateral movement throughout an organization's network.

Technologies: [Microsoft Windows DNS Server](https://junglewise.ai/threats/technologies/windows-dns). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-69813 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69813 being exploited in the wild.

**How severe is CVE-2026-69813?** High severity, with a CVSS score of 8.1, published 8 September 2026.

**Which products and versions are affected?** Microsoft Windows DNS Server.

**Is there a fix for CVE-2026-69813?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-69813 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-69813?** Check whether you run Microsoft Windows DNS Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in Windows DNS Server's memory management. The vulnerability can be triggered remotely over the network without authentication or user interaction required. An attacker can craft malicious DNS requests to trigger the use-after-free condition, leading to remote code execution with the privileges of the DNS service. The attack vector is network-based, affecting DNS servers that are directly reachable or accessible to the attacker. Patches are available from Microsoft.

## Affected products

- Microsoft Windows DNS Server

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: advisory

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69813](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69813)

## Related threats

- [Microsoft Windows DNS out-of-bounds read](https://junglewise.ai/threats/cve-2026-97006-out-of-bounds-read-in-windows-dns-allows-an-authorized-attacker)
- [Windows DNS Server use-after-free remote code execution](https://junglewise.ai/threats/cve-2026-96177-use-after-free-in-dns-server-allows-an-unauthorized-attacker-to)
- [Microsoft Windows DNS Server use-after-free denial of service](https://junglewise.ai/threats/cve-2026-96017-use-after-free-in-dns-server-allows-an-authorized-attacker-to)
- [Microsoft Windows DNS Server improper input validation spoofing](https://junglewise.ai/threats/cve-2026-119905-improper-input-validation-in-windows-dns-allows-an-authorized)
- [Windows DNS integer overflow in message parsing](https://junglewise.ai/threats/cve-2026-105579-integer-overflow-or-wraparound-in-windows-dns-allows-an)