Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-26223: Windows DNS Server allows hackers to run malicious code

CVE-2024-26223 · published 2 years ago

Summary

The Windows DNS Server has a security flaw that could allow an attacker to execute malicious code on a Windows server. This means that a hacker could potentially take control of the server, making it essential to update the DNS Server software to prevent exploitation. Windows administrators should apply the latest security patches as soon as possible to protect their systems.

What to do

Update microsoft windows_server_2016 to version 10.0.14393.6897 or later.
Update microsoft windows_server_2019 to version 10.0.17763.5696 or later.
Update microsoft windows_server_2022 to version 10.0.20348.2402 or later.
Update microsoft windows_server_2022_23h2 to version 10.0.25398.830 or later.

Affected software

Vendor	Product	Affected versions
microsoft	windows_server_2016	< 10.0.14393.6897 `cpe:2.3:o:microsoft:windows_server_2016::::::::`
microsoft	windows_server_2019	< 10.0.17763.5696 `cpe:2.3:o:microsoft:windows_server_2019::::::::`
microsoft	windows_server_2022	< 10.0.20348.2402 `cpe:2.3:o:microsoft:windows_server_2022::::::::`
microsoft	windows_server_2022_23h2	< 10.0.25398.830 `cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::`

Original advisory text

Windows DNS Server Remote Code Execution Vulnerability

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26223 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

6.6 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published9 Apr 2024

Updated3 Nov 2026

First seen11 Mar 2026

Sources

CVE-2024-26223 · OSV

CVE-2024-26223 · NVD

Track software like this

Free during beta