XHack
Author
Table of Contents
13
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: CVE-2026-69730 is an unauthenticated, no-click remote code execution bug in Windows DNS Server, and the scary part is where DNS usually runs.
- CVSS 9.8, and the vector is the bad kind.
AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H. A crafted packet arrives, code runs, nobody clicks anything.- A DNS bug is usually a domain-controller bug. In most Active Directory networks DNS runs on the DCs themselves, so RCE here means RCE on the crown jewels.
- Researchers are calling it a SigRed successor, but nobody has built the worm yet. The 2020 original (CVSS 10.0) went 17 years undetected. This one is a use-after-free, and self-propagation is still unproven.
- It is not being exploited yet, which is the whole point. Microsoft rates it “Exploitation More Likely.” You are ahead of this one for now. That window closes fast.
- Patching is the only real fix. It shipped in the September 8 updates, inside Microsoft’s biggest-ever Patch Tuesday (974 CVEs, 20 of them wormable).
Every few years a bug shows up that everyone in security quietly hopes stays theoretical. CVE-2026-69730 is this year’s.
It is an unauthenticated remote code execution flaw in Windows DNS Server, and it has the one property that turns a bad CVE into a historic one: it lives on a service that, in most corporate networks, runs on the domain controllers. The Zero Day Initiative already gave it a nickname that should make anyone who was working in 2020 sit up, “SigRed’s spiritual successor.”
Here is the good news, and it is real: as of this writing, nobody is exploiting it. That is not luck you get to keep. Let me explain what this is, why the DNS angle matters so much, and why “wormable” is a word worth using carefully.
Strip the branding and CVE-2026-69730 is a use-after-free (CWE-416) in the Windows DNS Server service, dns.exe. Microsoft patched it on September 8, 2026, and the NVD record rates it CVSS 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Read that vector, because it is the whole threat in shorthand:
A use-after-free happens when code keeps using memory after it has been freed, letting an attacker groom what lands in that reused space and steer execution. In CVE-2026-69730, a crafted DNS message pushes dns.exe into that stale-reference state and, handled right, ends in code execution on the server.
Microsoft has not published the specific DNS record type, message field, or parsing path involved, and I am not going to speculate my way into a map for exploit developers. The mechanism class is enough to understand the risk: a packet arrives, memory gets mishandled, and the DNS service can be made to run someone else’s code.
Affected versions run the full spread: Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core, plus Windows 10 1607 and 1809 in the product data. If it resolves names for you and it is a Windows Server, assume it is in scope until you have checked the build number.
This is the part that separates CVE-2026-69730 from the average critical CVE, and it is not about the bug at all. It is about where the vulnerable service lives.
In a Windows shop running Active Directory, DNS is not some appliance in the corner. AD depends on DNS to function, and the standard, Microsoft-recommended deployment is AD-integrated DNS running directly on the domain controllers. So the machine exposing the vulnerable dns.exe is very often the same machine that holds your directory and authentication, which is what makes CVE-2026-69730 punch so far above a normal DNS bug.
Chain that out and the stakes are obvious. Unauthenticated RCE on the DNS service becomes code execution on a domain controller. Code execution on a domain controller is, functionally, game over for the domain: credential theft, ticket forgery, persistence that survives a lot of cleanup. You do not pivot to the DC. You start there.
That is why a “just a DNS bug” reaction is exactly wrong. The DNS role is the delivery mechanism. The domain is the target.
Here is where I am going to slow down, because the word doing the heavy lifting in every headline deserves scrutiny.
A worm needs one thing beyond RCE: reliable, unattended self-propagation. The exploit has to work the same way, over and over, across different targets, without a human babysitting each hop, and it has to survive modern memory protections while doing it. That is a high bar, and it is a different bar from “an unauthenticated RCE exists.”
The case for the wormable label is strong on paper. The vector needs no credentials and no user interaction, which are the two things that usually stop a worm cold. The Zero Day Initiative flagged it among the wormable bugs in this batch and reached for the SigRed comparison directly. Microsoft’s own “Exploitation More Likely” rating says the company expects working exploits.
The case for caution is just as real: nobody has demonstrated a working, self-propagating exploit for CVE-2026-69730. Turning a use-after-free into reliable code execution is genuine work, and turning reliable code execution into a stable worm is more work still. Careful analysts have pointed out that calling every unauthenticated network RCE “wormable” on day one is premature, and they are right.
So the honest read is this: the ingredients for a worm are on the counter, and no one has proven they baked one. That is not a reason to relax. SigRed was rated wormable in 2020, and the industry took it deadly seriously precisely because waiting for proof means waiting until it is too late. Treat CVE-2026-69730 as a worm risk. Just do not let anyone tell you the worm already exists, because as of now, it does not.
The comparison is worth making concrete, because the two bugs rhyme without being identical.
SigRed (CVE-2020-1350) was a heap-based buffer overflow in how dns.exe processed oversized SIG resource records, discovered by Check Point after sitting in the code for 17 years. It scored a perfect 10.0, it was unauthenticated, and Microsoft itself warned it was wormable.
CVE-2026-69730 lands in the same service, with the same unauthenticated network profile, but it is a use-after-free rather than a buffer overflow, and it scores 9.8 rather than 10.0. Different bug class, same neighborhood, same nightmare deployment on domain controllers.
The lesson SigRed taught is the one that matters here: a DNS Server flaw with this profile is not a “patch it next cycle” item. In 2020 the organizations that treated it as routine were the ones still exposed when proof-of-concept code circulated. The clock on CVE-2026-69730 is running the same way.
The exposure question is simpler than usual: do you run the Windows DNS Server role, and is it patched?
The role is not enabled on a stock Windows Server, but it is effectively always present on AD domain controllers, which is exactly the population you care about most. Check it directly.
# Is the DNS Server role installed on this host?
Get-WindowsFeature -Name DNS | Where-Object Installed
# What build is dns.exe, and is it below the fixed version for your OS?
(Get-Item C:\Windows\System32\dns.exe).VersionInfo.ProductVersionCompare that build against the fixed versions Microsoft shipped on September 8 (for example, 10.0.17763.9245 on Server 2019 / Windows 10 1809, and 10.0.26100.33438 on Server 2025). Below the fix means exposed.
Then act in this order:
dns.exe, which has no business making strange connections.dns.exe for abnormal behavior: unexpected child processes, crashes, or memory anomalies on your DNS hosts are worth an alert given the memory-corruption nature of the flaw.There is no reliable packet signature to detect exploitation, because the triggering message structure is not public. That cuts both ways: it slows attackers down, and it means you cannot lean on a network rule instead of patching. Patch is the answer.
Short, because this is a news piece. The valuable move with a bug like CVE-2026-69730 is not waiting for a proof-of-concept to hit the news. It is inventorying your own exposure now, which DNS servers, which builds, which of them are domain controllers, and prioritizing accordingly. That asset-and-exposure mapping is exactly what the XHack platform and its AI agent are built to run continuously, so an unpatched DNS role on a DC surfaces as an active risk rather than a surprise the week a worm lands. When exploitation is still hypothetical, the teams that win are the ones who already know where they would get hit. Your data stays on your own machine while you find out.
CVE-2026-69730 is a critical use-after-free vulnerability in the Windows DNS Server service (dns.exe), rated CVSS 9.8. It lets an unauthenticated attacker send a specially crafted DNS message over the network and execute code on the server, with no credentials and no user interaction required. Microsoft patched it on September 8, 2026, as part of a record 974-CVE Patch Tuesday.
Not as of this writing. Microsoft rated it “Exploitation More Likely,” meaning the company expects working exploits to appear, and researchers have flagged it among the batch’s wormable bugs. But no active exploitation and no public proof-of-concept have been reported yet, which is precisely why patching now, ahead of the threat, is the whole opportunity.
Because of where DNS runs. In most Active Directory environments, DNS is AD-integrated and hosted directly on the domain controllers. That means an unauthenticated RCE in the DNS service translates into code execution on a domain controller, which effectively compromises the entire domain, its credentials, authentication, and every system that trusts it. The bug is the entry point; the domain is the prize.
It has the profile of a wormable bug, unauthenticated, no user interaction, network-reachable, and the Zero Day Initiative compared it to SigRed (CVE-2020-1350) directly. But wormability requires reliable, unattended self-propagation that survives memory protections, and nobody has demonstrated a working worm for this flaw. Treat it as a serious worm risk to be prevented, not as a worm that already exists.
Any host running the Windows DNS Server role: Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core, plus the affected Windows 10 builds. Prioritize domain controllers, since they almost always run AD-integrated DNS and are the highest-value target. Confirm the dns.exe build against Microsoft’s September 8 fixed versions.
CVE-2026-69730 is the rare CVE where you are, right now, ahead of the attackers. There is no worm, no public exploit, no active campaign. There is a patched, unauthenticated, no-click RCE in a service that mostly runs on your domain controllers, and a research community that took one look and said the word “SigRed.”
That word is a warning, not a verdict. The bug may never become the worm everyone fears. But the entire discipline of security is acting before the bad thing is proven, and the cost of acting here is one patch cycle. The cost of waiting for proof is measured in domain controllers.
Patch the DCs first. Patch the rest this week. And enjoy the unusual luxury of fixing this one before it has a name in the incident reports.
Related articles
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member) A leaked password is bad. A secret that […]...
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member) Read this in 30 seconds: CVE-2026-86218 is a [&hel...
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member) Read this in 30 seconds: StyleSmuggler is an [&hel...