A wormable Windows DNS Server flaw lets an unauthenticated attacker run code across a network with no clicks
CVE-2026-62878 is a Windows DNS Server RCE rated 9.8. Remote, unauthenticated, no clicks, and assessed as wormable via a stack-based buffer overflow. Microsoft $MSFT patched it in August among 421 CVEs. Unpatched DNS servers can let malware spread on their own.
The most dangerous software flaws are the ones that require nothing from the victim. CVE-2026-62878 is one of them. It is a remote code execution vulnerability in the Windows DNS Server, rated 9.8 out of 10 on the severity scale. A remote attacker who has not logged in at all can exploit it through a stack-based buffer overflow, with no clicks and no user interaction, and security analysts assess it as potentially wormable. Microsoft addressed it in the August 2026 Patch Tuesday, which fixed 421 vulnerabilities in total, including one zero-day already exploited in the wild. The word wormable is what makes this stand out. A wormable flaw lets malicious code jump from one machine to the next without human help, which is how the most damaging outbreaks of the past decade spread so quickly. DNS servers sit at the core of nearly every corporate network, so an unpatched one is not just a single weak point but a launchpad. The practical takeaway is simple: organizations running Windows DNS should treat this patch as urgent rather than routine.