Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A single crafted packet, no credentials required, what this September 2026 Patch Tuesday critical actually means for infrastructure that often runs directly on a domain controller.
Microsoft's September 2026 Patch Tuesday addressed a record 964 CVEs, 104 rated Critical, 860 rated Important, and buried inside that record volume was one flaw worth understanding on its own: CVE-2026-69730, a critical remote code execution vulnerability in Windows DNS Server, scored 9.8 on CVSS. Tenable's analysis of the release describes it plainly: an unauthenticated, remote attacker can send a single crafted packet to a vulnerable DNS server and trigger a use-after-free flaw that leads to code execution, no credentials, no user interaction, no prior foothold required.
A use-after-free vulnerability happens when a program keeps using a piece of memory after it's already been freed for reuse, an attacker who can control what gets placed in that freed memory can often hijack the program's execution. In a DNS server, that's a particularly serious place for the bug to live: DNS is infrastructure every other service depends on, it processes untrusted input by definition (any client on the network can send it a query), and Windows DNS Server frequently runs directly on domain controllers, meaning a successful exploit can land an attacker on one of the single most privileged machines in an entire Active Directory environment.
Microsoft assessed exploitation as "More Likely," even though this specific flaw hadn't been observed exploited in the wild at disclosure, the same Patch Tuesday did include two separate zero-days that were already being actively exploited (CVE-2026-81963 and CVE-2026-85880, both privilege-escalation flaws), which is a reminder that "not yet exploited" and "not exploitable" are very different statements, and the gap between disclosure and mass scanning for a bug like this is typically measured in days.
If your DNS infrastructure runs on Windows Server and hasn't received September's cumulative update, this is the patch to prioritize over the other 963 in the release, not because the others don't matter, but because remote, unauthenticated code execution against infrastructure this central is about as close to worst-case as a CVE gets. This is exactly the reasoning behind treating CVSS score as a starting point, not the whole prioritization strategy, exploitability, exposure, and what the affected system actually is all change how urgently a given CVE deserves attention, and a DNS server sitting on a domain controller changes the calculus considerably compared to the same CVSS score on an isolated workstation.
It's also a reminder of how much a single flaw in core Windows infrastructure can widen an Active Directory attack path, a domain controller compromised through a DNS server flaw isn't an isolated incident, it's often the starting point for full domain compromise. Checking whether your own exposed infrastructure and its patch level are visible from outside is a reasonable first step, our free CVE Lookup tool and Domain Footprint Analyzer are a starting point, and our Network Security and Security Engineering services cover the deeper review of how quickly critical patches like this one actually reach production infrastructure.
Tell us about your environment and goals, we'll help you scope the right engagement.