www.tenable.com Critical Windows DNS RCE Vulnerability CVE-2026-69730 Disclosed
Article Content
- •CVE-2026-69730 is a critical RCE vulnerability in Windows DNS Server with CVSS 9.8.
- •It allows unauthenticated code execution, primarily affecting domain controllers.
- •Microsoft released a patch on September 8, 2026, amid a massive Patch Tuesday update.
CVE-2026-69730 is a critical unauthenticated remote code execution vulnerability in Windows DNS Server, rated CVSS 9.8. It allows attackers to execute code without user interaction, primarily affecting domain controllers in Active Directory networks. This vulnerability is being compared to the infamous SigRed (CVE-2020-1350), which went undetected for 17 years. As of now, there are no known exploits in the wild, but Microsoft has warned that exploitation is more likely. The vulnerability was patched on September 8, 2026, as part of a significant Patch Tuesday update that addressed 974 CVEs, including 20 that are wormable. Organizations are urged to apply the patch immediately to mitigate potential risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2020-1350 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Meta React Server Components Discovered CVE-2025-55182 is a critical remote code execution vulnerability in Meta React Server Components, with a CVSS score of 10.0. It allows unauthenticated attackers to execute arbitrary commands on the server by sending crafted JSON payloads. This vulnerability was added to CISA's Known Exploited Vulnerabilities catalog…