Microsoft patches nine Windows DNS Server RCEs, including a CVSS 9.8 use-after-free
The September 8, 2026 Patch Tuesday fixes nine remote code execution flaws in Windows DNS Server, including CVE-2026-69730, a CVSS 9.8 use-after-free triggerable with a single forged packet. Patch the servers running the DNS role first and segment port 53 before a public exploit appears.
September 8, 2026. Microsoft shipped its September Patch Tuesday, and with it 964 fixed CVEs — a record that smashes July’s release. Buried in that volume are nine remote code execution flaws in the Windows DNS Server role. The worst, CVE-2026-69730, is a use-after-free scored CVSS 9.8, triggerable by a single forged packet with no authentication and no user interaction. Why it matters: one month after CVE-2026-62878, the “wormable” stack overflow patched in August, Microsoft is again closing nine doors into the most exposed network service in most estates.
A use-after-free that only needs one packet
CVE-2026-69730 is rated critical by Microsoft, which describes it as a use-after-free in Windows DNS. The mechanics are blunt: an unauthenticated, remote attacker sends a specially crafted packet to the DNS service, and freed memory is reused before it has been invalidated — allowing arbitrary code execution.
The severity does not come from sophistication but from the attack profile. All three properties hold at once:
- Remote. The attacker needs no prior foothold, only the ability to reach the server on port 53.
- Unauthenticated. No credentials, no session, nothing to steal or guess first.
- Zero interaction. Nobody has to open anything: the DNS server processes the malicious packet as part of its ordinary job.
That is the same trio of properties that has historically turned a flaw into a worm. Microsoft placed this CVE in its “exploitation more likely” bucket rather than “less likely” — a rare signal in a monthly bulletin.
Nine flaws, one service
CVE-2026-69730 is not alone. The same Patch Tuesday fixes eight more RCEs in the DNS Server role. None reaches the same exploitability rating, but the pile-up tells its own story about the attack surface.
| CVE | CVSSv3 | Severity | Microsoft assessment |
|---|---|---|---|
| CVE-2026-69730 | 9.8 | Critical | Exploitation more likely |
| CVE-2026-69813 | 8.1 | Critical | Exploitation less likely |
| CVE-2026-69858 | 8.1 | Critical | Exploitation unlikely |
| CVE-2026-77505 | 8.1 | Critical | Exploitation less likely |
| CVE-2026-69827 | 8.1 | Critical | Exploitation unlikely |
| CVE-2026-69551 | 8.8 | Important | Exploitation less likely |
| CVE-2026-69782 | 8.1 | Important | Exploitation unlikely |
| CVE-2026-69989 | 8.1 | Important | Exploitation unlikely |
| CVE-2026-72928 | 7.5 | Important | Exploitation less likely |
Nine flaws in a single component is an unusual month. It is also a reminder that the DNS Server role is not an incidental add-on to Windows Server: it is a full network service, parsing untrusted input from outside, and it deserves its own security review.
Why DNS remains the most exposed service
DNS is the service almost nobody actually segments. Port 53 is open by design: internal resolvers query the server, secondaries replicate zones, and in many environments the server also answers recursive queries for the whole estate.
That exposure is silent. A busy CISO tracks application CVEs and appliances, but the DNS server — because it “just works” — slides to the bottom of the stack. Yet it is exactly the kind of target an unauthenticated RCE turns into a pivot point: once code runs on the DNS server, the attacker is already at the heart of the network, on a machine that sees name resolution for the entire company.
The number that matters is not the 9.8 alone; it is the pairing of “no authentication” with “no interaction”. It lowers the barrier to entry to the bare technical minimum: send a packet.
Two months running: the August precedent
On August 11, 2026, Microsoft fixed CVE-2026-62878, a stack-based buffer overflow in Windows DNS Server, also at CVSS 9.8 and described by researchers as “wormable”. The word needs precision: it describes the shape of the flaw — remotely reachable, no credentials, no interaction — not a confirmed spread. As of this writing, no in-the-wild exploitation has been confirmed for CVE-2026-62878.
The precedent matters for two reasons. First, it shows the September wave is not an isolated accident but a recurring pattern on the same component. Second, it illustrates the window teams face: for a flaw of this profile, the gap between disclosure and a public proof of concept is measured in days, not weeks. Patching before that window is the whole difference between an anticipated incident and a race against opportunistic scanning.
What to put in place
Four actions, in descending priority:
- Inventory the servers running the DNS Server role. The flaw is in the role, not in Windows Server generally. Your patch queue should start with those machines, not the whole estate.
- Apply the September cumulative update to those hosts first, ahead of the usual monthly rollout.
- If you cannot patch immediately, restrict network access. Allow only known secondary resolvers and management hosts to query the server, rather than leaving port 53 broadly reachable. This is a stopgap, not a fix.
- Watch for a public exploit. Once a proof of concept circulates, any server still unpatched moves from “patch soon” to “patch today”.
Add a scheduled check that verifies the DNS Server role is actually covered by the September update. The worst configuration is not the unpatched server you know about; it is the one you forgot to inventory.
Verdict
If you run domain controllers — which almost always carry the DNS role — or any DNS server reachable from the network, treat CVE-2026-69730 as an immediate scheduling incident: it combines the highest score and the highest exploitability rating in an already-record bulletin. If your DNS server is already segmented and answers only to trusted hosts, the margin is more comfortable, but the patch is still due before an exploit appears. In either case, write down the inventory of servers carrying the DNS role: that is the only durable defense against the next bulletin, which — at the current pace — will not be long.