Loading story…
Microsoft has published a cluster of DNS-related security advisories covering remote code execution, denial of service, cache poisoning, heap overflow, and access-control bypass conditions across Windows DNS Server and third-party DNS components. The newly listed issues include CVE-2026-33278 for possible arbitrary code execution during DNSSEC validation, CVE-2026-42959 for crashes triggered by malicious DNSSEC content, CVE-2026-42960 for possible cache poisoning through promiscuous authority-section records, and CVE-2026-42944 for a heap overflow involving multiple NSID, COOKIE, and PADDING EDNS options. Additional advisories describe degradation-of-service conditions tied to long EDNS option lists (CVE-2026-41292), unbounded name compression (CVE-2026-44390), and a "packet of death" affecting DNSCrypt (CVE-2026-32792).
The disclosures also reference flaws in widely used DNS software, including a BIND 9 resolver unbounded resend loop (CVE-2026-5950), invalid handling of CLASS != IN (CVE-2026-5946), and a CoreDNS ACL bypass (CVE-2026-26017). Earlier Microsoft advisories for Windows DNS Server remote code execution, including CVE-2021-33754 and CVE-2021-33746, show that DNS services remain a recurring high-impact target because they are network-exposed and central to enterprise operations. For defenders, the combined set of advisories highlights the need to prioritize patching DNS infrastructure, review exposure of DNSSEC, EDNS, and DNSCrypt features, and monitor for service instability or anomalous DNS responses that could indicate exploitation attempts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft published advisories for CVE-2026-5950, an unbounded resend loop in the BIND 9 resolver, and CVE-2026-5946, invalid handling of CLASS != IN. These disclosures added further DNS software flaws to the set of Microsoft-tracked issues.
Microsoft published advisories for several DNS vulnerabilities on the same day, including possible arbitrary code execution during DNSSEC validation (CVE-2026-33278), a crash during DNSSEC validation of malicious content (CVE-2026-42959), cache poisoning via promiscuous authority records (CVE-2026-42960), performance degradation from long EDNS option lists (CVE-2026-41292), unbounded name compression degradation of service (CVE-2026-44390), a DNSCrypt packet-of-death issue (CVE-2026-32792), and a heap overflow involving multiple EDNS options (CVE-2026-42944).
Microsoft published guidance for CVE-2026-26017, described as a CoreDNS ACL bypass vulnerability. The advisory indicates a new DNS-related security issue was formally tracked and disclosed by Microsoft.
Microsoft disclosed CVE-2021-33754 and CVE-2021-33746 as Windows DNS Server remote code execution vulnerabilities and indicated security updates were available. For CVE-2021-33754, Microsoft rated the issue Important, said it was not publicly disclosed or exploited in the wild at publication, and assessed exploitation as less likely.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for a broad set of **denial-of-service** vulnerabilities affecting Windows components and related software, including **IP Helper** (`CVE-2025-21231`), **Windows Virtual Trusted Platform Module** (`CVE-2025-21280`), **Windows Remote Desktop Services** (`CVE-2025-21330`), **DHCP Client Service** (`CVE-2025-21179`), **Windows Active Directory Domain Services API** (`CVE-2025-21351`), **Windows Hyper-V** (`CVE-2025-62567`), **Windows Kerberos** (`CVE-2022-41053`), and **Microsoft Defender** (`CVE-2023-36010`). The disclosures indicate continued exposure of core enterprise infrastructure services to attacks that can disrupt availability without necessarily compromising data or system integrity. Microsoft also issued an advisory for **Prometheus** remote read endpoint vulnerability `CVE-2026-42154`, describing a remotely exploitable flaw caused by a crafted **snappy** payload that can trigger uncontrolled resource consumption. Microsoft rated the issue **CVSS 7.5** and said it requires **no privileges** and **no user interaction**, with impact focused on sustained or persistent service outages. Together, the advisories highlight availability risks spanning identity, networking, virtualization, endpoint protection, remote access, and monitoring systems commonly deployed in enterprise environments.
Jun 29, 2026
Microsoft’s May 2026 Patch Tuesday resolved between **120 and 137 vulnerabilities** across Windows, Office, networking services, Hyper-V, SharePoint Server, and Microsoft Dynamics 365 on-premises, including **17 to 30 critical flaws**. Microsoft said the release contained **no publicly disclosed or actively exploited zero-days**, but multiple high-risk issues affected core enterprise infrastructure. Notable vulnerabilities included unauthenticated remote code execution in **Windows Netlogon** (`CVE-2026-41089`) and the **Windows DNS Client** (`CVE-2026-41096`), a **Hyper-V guest-to-host escape**, a SharePoint Server RCE (`CVE-2026-40365`), and a **Dynamics 365 on-premises** RCE (`CVE-2026-42898`) rated **CVSS 9.9**. The update also addressed Office and endpoint attack paths, including Microsoft Word flaws and `CVE-2026-35421`, which could allow code execution through malicious **EMF** files opened in Microsoft Paint via Windows GDI. Security researchers said organizations should prioritize patching **domain controllers**, **DNS-exposed Windows systems**, **on-premises collaboration platforms**, and **user endpoints** because of their exposure and likely exploitability. Alongside the security fixes, Microsoft issued mandatory Windows 11 cumulative updates **KB5089549** and **KB5087420** for versions **25H2, 24H2, and 23H2**, adding platform changes such as File Explorer, accessibility, storage, printing, and secure batch file processing improvements.
Jun 29, 2026
ISC released security advisories addressing several high-severity vulnerabilities in *BIND 9* DNS software, affecting versions 9.11.x, 9.16.x, 9.18.x, 9.20.x, and 9.21.x. These flaws could allow attackers to conduct cache poisoning and denial of service (DoS) attacks, potentially disrupting DNS resolution and compromising the integrity of DNS responses. The vulnerabilities are tracked as CVE-2025-8677, CVE-2025-40778, and CVE-2025-40780, and have been rated as critical due to their potential impact on DNS infrastructure. Administrators are strongly advised to review the official advisories and apply the necessary patches to affected BIND 9 deployments. The Canadian Centre for Cyber Security and other security organizations have issued alerts urging immediate action to mitigate the risk of exploitation. Failure to update could expose organizations to significant operational and security risks, including service outages and the possibility of malicious redirection of network traffic.
Jun 29, 2026