Security Advisory catalog CVE-2026-61920 Historical advisory recorded 30 Oct 2026 18:45:26 UTC. Read the latest advisory .
cve-program · CVE-2026-61920 Published
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-61920 Published Windows Server 2012 R2 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Windows Server 2012 R2",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.3.9600.0",
"lessThan": "6.3.9600.23338",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2012 R2 (Server Core installation) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Windows Server 2012 R2 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.3.9600.0",
"lessThan": "6.3.9600.23338",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2016 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Windows Server 2016",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9418",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2016 (Server Core installation) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Windows Server 2016 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9418",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2019 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Windows Server 2019",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9121",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2019 (Server Core installation) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Windows Server 2019 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9121",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2022 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Windows Server 2022",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.20348.0",
"lessThan": "10.0.20348.5499",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2025 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Windows Server 2025",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33296",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2025 (Server Core installation) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Windows Server 2025 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33296",
"versionType": "custom",
"status": "affected"
}
]
} Original source record · Cite this exact observation · Complete original publisher JSON