CVE-2026-78523 is a medium severity (CVSS 5.9) denial of service flaw in Windows DNS Server. The fix is the September 2026 Windows security update. Microsoft has not marked it as exploited at release, and the CISA KEV flag is false. Check the MSRC entry for your exact build.
What's affected
Windows DNS Server. The record lists the affected product families, and Microsoft's September 2026 update data lists the specific builds and the update (KB) number for each. Microsoft's data lists the customer action as required, so the fix is a normal security update.
The record lists Windows Server 2012, 2016, 2019, 2022 and 2025, and Windows 10 versions 1607 and 1809. The issue concerns the DNS Server role, so machines without that role are not the main concern.
Microsoft's data marks the issue as not publicly disclosed and not exploited at release, with an exploitability assessment of Exploitation Unlikely. The record's KEV flag is false. An assessment of this kind can change, so recheck the entry if the issue matters to you.
How to check if you're exposed
Find out which servers run the DNS Server role.
Get-WindowsFeature DNS
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Then compare the update level to the entry in the MSRC update guide. Update numbers differ by Windows Server version.
What to do now
- Open the Microsoft update guide entry and find the update that applies to your exact build.
- Deploy the September 2026 security update through your normal patch process, test group first, then broad rollout.
- Confirm the update installed on a sample of machines, then report coverage across the fleet.
- Patch domain controllers that run DNS in a staggered order so name resolution stays available throughout.
Why it matters
The weakness is CWE-416, use after free. Use after free means memory is reused after it was released. Microsoft describes only the denial of service result here. For a DNS server, an outage matters because many other services fail when names stop resolving, so even a medium rated crash deserves a place in the normal patch cycle.
The published description is a single sentence, and Microsoft does not add technical detail for most of these issues. That is typical, and it is the reason to judge risk by exposure: who can reach the vulnerable component, and how fast you can patch it. The record has no privileges and no user interaction but high complexity, with impact on availability only.
Quick check
Does it affect DNS clients?
The record names Windows DNS, meaning the server role, not the client resolver.
Is it a high priority?
The score is medium and Microsoft rates exploitation unlikely, but a DNS outage has wide effects, so patch within your normal cycle.
Sources
Last reviewed: 18 October 2026.
