Microsoft’s August 2026 Patch Tuesday, released August 11, closed out four separate Critical remote code execution vulnerabilities in Windows DNS Server — the most concentrated single-component patch target of the month. The headline bug, CVE-2026-62878, is a stack-based buffer overflow that researchers have already characterized as wormable: no authentication, no user interaction, just a specially crafted packet sent to an exposed DNS service.

What happened

Windows DNS Server ships as a core role on most enterprise Active Directory deployments, and it’s frequently internet-facing on top of that — recursive resolvers, secondary zones accepting transfers from external primaries, and forwarders sitting at network edges are all common configurations. CVE-2026-62878 lives in how the service parses incoming DNS packets: a stack-based buffer overflow (CWE-121) that an unauthenticated remote attacker can trigger with a single crafted packet, with no user interaction and low attack complexity. Security researchers at the Zero Day Initiative and elsewhere flagged it as “a good ol’ fashioned stack-based buffer overflow” with wormable characteristics — the same class of bug that powered self-propagating worms like WannaCry’s EternalBlue chain, though no working self-propagating exploit has been publicly demonstrated yet.

Microsoft shipped three companion Windows DNS Server RCEs in the same release:

  • CVE-2026-62817 (CVSS 8.8) — an out-of-bounds write (CWE-787) reachable by an attacker on an adjacent network calling arbitrary endpoints within the service.
  • CVE-2026-62820 (CVSS 8.1) — a race condition (CWE-362) requiring the attacker to win a timing window during concurrent request handling.
  • CVE-2026-65789 (CVSS 8.1) — a use-after-free (CWE-416) that needs specific network configurations and timing conditions, making exploitation less reliable across arbitrary environments but not impossible.

None of the four is confirmed under active exploitation as of this writing, and Microsoft rates in-the-wild exploitation of CVE-2026-62878 itself as “less likely” — but that assessment has aged poorly for comparable DNS and SMB-adjacent bugs in the past, and the wormable framing alone is enough to treat this as an emergency-patch item rather than a routine monthly rollout.

Technical details

  • CVEs: CVE-2026-62878 (CVSS 9.8, stack buffer overflow), CVE-2026-62817 (CVSS 8.8, out-of-bounds write), CVE-2026-62820 (CVSS 8.1, race condition), CVE-2026-65789 (CVSS 8.1, use-after-free) — all in the Windows DNS Server role
  • Affected: Windows Server 2012 through Server 2025, across all editions running the DNS Server role, plus the subset of client Windows 10/11 builds that ship the vulnerable component
  • Attack vector: network, unauthenticated, no user interaction for CVE-2026-62878; CVE-2026-62817 requires adjacent-network positioning; CVE-2026-62820 and CVE-2026-65789 require winning race conditions or specific configuration/timing states
  • Exploit maturity: no public proof-of-concept or confirmed in-the-wild exploitation reported as of August 13; Microsoft’s exploitability assessment for CVE-2026-62878 is “exploitation less likely,” which several researchers are treating skeptically given the bug class
  • Fixed: Microsoft’s August 2026 Patch Tuesday cumulative updates, released August 11

Impact

DNS Server is one of the few Windows roles that’s designed to be reachable — from adjacent segments at minimum, and directly from the internet in a meaningful number of real-world deployments (secondary zone transfers, public-facing resolvers, forwarders). A wormable, unauthenticated, CVSS 9.8 RCE in that role is close to a worst-case combination: successful exploitation of CVE-2026-62878 hands an attacker code execution on a domain controller or dedicated DNS server with no prior access required, which in an Active Directory environment is frequently one hop from full domain compromise. The three companion bugs widen the exposure window for organizations that can’t patch everything in one maintenance cycle — an attacker with adjacent network access or the ability to win a race condition has three additional paths into the same service.

Mitigation

  • Patch Windows DNS Server hosts first, ahead of the rest of the August cumulative rollout — treat any internet-facing or perimeter-adjacent DNS Server instance as priority zero.
  • Verify the update actually applied: confirm the August 2026 security update is approved for each server’s specific Windows Server version, installed successfully, and that the server has completed its required restart — a stalled or failed install leaves the host silently unprotected.
  • Restrict DNS Server network exposure where patching can’t happen immediately: firewall rules limiting inbound DNS queries to known resolvers/forwarders, and disabling zone transfers to untrusted secondaries.
  • Monitor for anomalous DNS Server crashes or restarts, which can indicate failed exploitation attempts against the stack overflow or race-condition bugs before a working exploit chain matures.
  • Don’t defer based on Microsoft’s “exploitation less likely” rating alone — wormable stack overflows in widely deployed, network-facing services have a track record of moving from “less likely” to “actively exploited” faster than patch cycles complete.

Sources: The Hacker News — Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack, Security Affairs — Microsoft Patch Tuesday for August 2026 Fixed a Zero-Day and Wormable RCE, Zero Day Initiative — The August 2026 Security Update Review, Microsoft Security Update Guide — CVE-2026-62878, Microsoft Security Update Guide — CVE-2026-62820.