Windows DNS Server CVE-2026-62878: a Wormable Pre-Auth RCE on Every Domain Controller

On 11 August, in a Patch Tuesday that closed 398 CVEs, one line in the advisory should have stopped every Windows admin cold: a wormable, unauthenticated remote code execution bug in Windows DNS Server. CVE-2026-62878 carries a CVSS of 9.8, needs no credentials, no user interaction, and low attack complexity — and it lives in a service that, in most Windows estates, runs on the domain controllers. Microsoft's own exploitability assessment reads "Exploitation Less Likely." That phrase is not the all-clear. It is a countdown.

What CVE-2026-62878 actually is

The Zero Day Initiative's August review describes it plainly: "a good ol' fashioned stack-based buffer overflow that ends up wormable." Classified as CWE-121, the flaw is reachable by sending specially crafted packets to an affected DNS server. There is no login step, no phishing lure, no second stage required to reach the vulnerable code — the parser handles attacker-controlled data before any trust boundary is crossed. Successful exploitation yields code execution with the privileges of the DNS service, which on Windows runs as a highly privileged local account.

Affected builds span Windows Server 2012 through Server 2025 — every currently supported release that can hold the DNS Server role, including 2016, 2019 and 2022. Microsoft did not publish a single tidy KB identifier; the fix ships per operating-system build inside the August cumulative update, which means "are we patched" has to be answered per host, not per fleet.

It did not arrive alone. The same Patch Tuesday shipped two more unauthenticated, CVSS 9.8 remote-code bugs in network-facing Windows services — CVE-2026-62893 in the Windows Deployment Services TFTP server (reachable over UDP/69) and CVE-2026-62815 in Microsoft QUIC — plus a CVSS 8.8 RCE in the DHCP Server. The August update was a cluster of pre-auth network RCEs. DNS is the one that matters most, because of where it sits.

Why "exploitation less likely" is the window, not the all-clear

Security teams have learned to read Microsoft's exploitability index as a triage aid. It is a good aid, but for a bug with this shape it measures the wrong thing. "Less likely" reflects how hard the exploit is to write today — the buffer overflow needs a working memory-corruption chain against a hardened, ASLR-and-CFG-protected service. It says nothing about what happens after the first reliable proof-of-concept lands on GitHub.

We have run this exact tape before. In July 2020, Check Point disclosed SIGRed — CVE-2020-1350 — a 17-year-old wormable RCE in the same Windows DNS Server, rated CVSS 10.0. CISA issued Emergency Directive 20-03 giving federal agencies a single day to patch. There was no mass worm in the end — because the industry treated "wormable Windows DNS RCE" as the five-alarm event it was and patched inside the window. The absence of a catastrophe was the result of the response, not evidence the threat was overblown. Treating this year's version as routine because last time nothing burned down inverts the lesson.

"We'll get to it in the next maintenance window — Microsoft says exploitation is less likely."

That sentence is exactly what an attacker is betting on. The gap between patch release and reliable exploitation is where the entire race is decided, and it is measured in days, not quarters.

The domain controller problem

Here is what makes CVE-2026-62878 different from a wormable bug in some edge appliance. In an Active Directory environment, the DNS Server role is almost always co-located with AD DS on the domain controllers. Active Directory is DNS-dependent: clients find domain controllers through SRV records, and the standard, Microsoft-recommended deployment runs AD-integrated DNS on the DCs themselves.

So "patch your DNS servers" is, for most organisations, a euphemism for "patch your domain controllers" — the single most sensitive class of asset you own. Code execution in the DNS service on a DC is a step away from the keys to the directory: SYSTEM on a domain controller, then Kerberos ticket forging, then the entire identity plane. An attacker who reaches this from an unauthenticated network position has skipped every early stage of the intrusion kill chain.

And because the bug is wormable, one compromised DNS server does not stay one. A self-propagating exploit turns each infected DC into a launch point for the next — internal DNS servers talk to each other constantly, and the traffic to carry the exploit looks, at the packet level, like the DNS traffic those servers are supposed to exchange.

How a wormable DNS RCE moves through a network

A worm needs three things: a vulnerable, reachable service; a reliable exploit; and a target list. CVE-2026-62878 supplies the first two once a PoC exists. The third is trivial in an AD environment — a compromised DC already knows every other DNS server in the forest, because it replicates with them.

The propagation signature is the tell. A domain controller's DNS service is, in steady state, a responder: it answers queries and performs recursion to a small set of forwarders. A DC that has been turned into patient zero starts doing something it has never done — emitting crafted, oversized packets toward other DNS servers, initiating connections it normally receives, fanning out along replication paths at machine speed. None of this trips a signature engine, because there is no malware file to hash and the packets are well-formed DNS on the expected port. What betrays it is the behaviour: a box that only ever ingested is now aggressively originating, to peers, in a burst pattern no human administrator produces.

Remediation

Treat this as a domain-controller emergency, not a routine DNS patch. The runbook below is ordered for a service you cannot simply switch off.

1. Am I affected?

Enumerate every host running the DNS Server role, not just the ones you think of as "DNS servers":

# Across the domain: every server with the DNS role installed
Get-ADComputer -Filter * -Properties OperatingSystem |
  ForEach-Object {
    if (Get-WindowsFeature -ComputerName $_.Name -Name DNS -ErrorAction SilentlyContinue |
        Where-Object Installed) { $_.Name }
  }

# On a suspect host, confirm the service and the running build
Get-Service DNS
systeminfo | findstr /B /C:"OS Version"

Every domain controller in a standard AD deployment is in scope. So is any member server promoted to DNS, and any standalone Windows DNS appliance in a DMZ — the internet-facing ones are the highest priority.

2. Patch — the exact fix

Apply the August 2026 cumulative update for each affected OS build. There is no single KB; match each host's Windows build to its August 2026 Security Update Guide entry and confirm the post-patch build number rather than trusting the update history UI. Reboot is required for the DNS service to load the fixed binary. Domain controllers should be patched on the same emergency cadence you would use for a KEV-listed flaw, even though this one is not (yet) on the catalog.

3. Can't patch this hour? Compensating controls

DNS cannot be taken offline in an AD environment, so reduce reachability instead of availability:

• Block the exploit at the perimeter. No domain controller's DNS service should ever be reachable from the internet. Confirm UDP/TCP 53 to DCs is denied inbound at the edge. External-facing authoritative DNS should not run on a DC at all.
• Segment internal DNS. Restrict which hosts can initiate DNS to your DCs; a worm's fan-out depends on DC-to-DC and client-to-DC reachability on 53.
• The SIGRed-era registry mitigation still applies as defense-in-depth. Capping the maximum TCP DNS packet length (TcpReceivePacketSize = 0xFF00) under HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters and restarting the service shrinks the surface for TCP-based overflow paths. This is a stopgap, not a substitute for the patch — apply it only if you genuinely cannot reboot yet, and reverse it after patching.

4. Hunt for compromise

Because there is no file artifact, hunt on behaviour and process lineage, mapped to MITRE ATT&CK:

• Crash-loop signal. Repeated dns.exe crashes or DNS service restarts (Windows Event IDs 1000/7031/7034 referencing the DNS service) are the classic pre-reliability footprint of an exploit being tuned. Alert on them.
• Anomalous process ancestry — any child process spawned by dns.exe is high-fidelity. A DNS service does not launch cmd.exe, powershell.exe, or rundll32.exe. Maps to T1190 (Exploit Public-Facing Application) at the entry and T1059 at the follow-on.
• Outbound from a responder. A DC's DNS service originating crafted/oversized packets to other DNS servers, or new outbound connections from the DNS service to internal peers, is the worm's propagation — T1210 (Exploitation of Remote Services) across the fan-out.
• Post-exploit staples on the DC — new services, scheduled tasks, or local accounts appearing on a domain controller shortly after a DNS restart (T1543, T1053, T1136).

5. Eradicate and verify

If a DC shows any of the above, treat it as a directory-level compromise, not a single-host incident:

• Isolate the DC, but plan for AD continuity first — DNS and authentication depend on it.
• Assume identity material is exposed. Rotate the krbtgt password twice (with the required replication interval between rotations), reset the affected DC's machine account, and rotate privileged credentials that authenticated through it.
• Rebuild the DC from known-good media rather than cleaning in place; SYSTEM-level code on a domain controller cannot be reliably scrubbed.
• Verify after patching: confirm the fixed build number, confirm no residual dns.exe child processes or unexpected services, and re-baseline the DNS service's outbound behaviour.

Catching the worm mid-spread — and closing the exposure first

The uncomfortable truth of a wormable, file-less DNS exploit is that the tools most estates rely on look in the wrong place. EDR watches endpoints for malicious files and process trees; a stack-overflow-to-shellcode chain that lives in the DNS service's memory and propagates as well-formed DNS packets gives the file-centric sensor very little to match. Signature-based NDR is no better — there is no signature for "legitimate DNS packet, sent by a server that should never send it."

This is the case Zero Hunt's AI Traffic Analysis was built for. A proprietary deep-learning model, trained on billions of PCAP sequences and running locally on the appliance GPU at 2.7+ Gbit/s, scores traffic behaviourally across four parallel inference heads — suspicious traffic, malware classification, attack-type identification, and application fingerprinting. The signal that betrays a DNS worm is exactly the kind the model is tuned to surface: a host whose role has silently inverted, a responder that has started to originate, a burst of DC-to-DC packets that fit no human cadence. It sees the fan-out while it is happening, not in the next morning's SIEM digest — which, for a machine-speed worm, is the difference between one compromised DC and the whole forest.

Detecting the spread is the second-best outcome. The best is proving the door was never open. Zero Hunt's change-triggered campaigns fire a full generative assessment within the hour when a new asset appears on the perimeter — so a DNS server that gets exposed to the internet by a misconfigured firewall rule is validated against a fresh, per-target exploit attempt before an external worm ever finds it. The 10-agent swarm writes the exploit for your environment rather than replaying a public PoC, and every finding is backtested in the AI Gym and ECDSA-signed for the audit trail. "Exploitation less likely" stops being a bet you place on the attacker's calendar and becomes a claim you can actually test against your own domain controllers — before the countdown runs out.