{"id":"CVE-2026-70167","published":"2026-10-13T19:19:30.537","lastModified":"2026-10-16T10:45:34.170","description":"Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-822","CWE-843"],"vendors":["microsoft"],"products":["windows server 2022","windows server 2025"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70167","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A type confusion vulnerability in Microsoft's DNS Server allows authenticated attackers to execute arbitrary code remotely. This occurs when the DNS server incorrectly handles resource types, leading to potential remote code execution with high severity.","exploitability":"Exploitation requires an authenticated user with access to the DNS server, making it moderately difficult but possible given sufficient privileges, with no additional preconditions beyond network access and authentication credentials.","blast_radius":"If exploited, this vulnerability could allow attackers to execute code on DNS servers running Windows Server 2022 or 2025, potentially leading to full domain compromise and lateral movement throughout the network.","remediation":"Apply the latest security updates for Windows Server 2022 and Windows Server 2025, specifically targeting the DNS Server component with the fixes included in the March 2026 security updates.","detection":"Monitor for unusual DNS query patterns or unexpected resource type handling in DNS server logs, particularly around zone transfers or dynamic updates that might indicate type confusion exploitation attempts.","tags":["dns","rce","windows-server"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:55:29.893Z"}}