CVE-2026-50426Important

Windows DNS Server Remote Code Execution Vulnerability

Assessment

Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.

Severity: Important
CVSS base score: 6.8CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact: Remote Code Execution
EPSS, next 30 days: 0.6%Higher than 44.2% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability: Exploitation Unlikely
Publicly disclosed: No
Customer action: Required: apply the update
Component: Role: DNS Server
Weakness: CWE-23: Relative Path Traversal
Issued by: Microsoft
Published: 14 Jul 2026 · July 2026
Last revised: 14 Jul 2026

6 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5099444	Monthly Rollup	Required	Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)	All CVEs in KB5099444
KB5099445	Monthly Rollup	Required	Windows Server 2012, Windows Server 2012 (Server Core installation)	All CVEs in KB5099445
KB5099535	Security Update	Required	Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2016 and 1 more	All CVEs in KB5099535
KB5099536	Security Update	Required	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5099536
KB5099538	Security Update	Required	Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019 and 1 more	All CVEs in KB5099538
KB5099540	Security Update	Required	Windows Server 2022	All CVEs in KB5099540

ESU, Windows

15 affected products