Loading story…
Microsoft disclosed and patched SIGRed (CVE-2020-1350), a critical Windows DNS Server vulnerability affecting supported and legacy Windows Server releases from 2003 through 2019. The flaw carries a CVSS score of 10.0 because an unauthenticated attacker can trigger remote code execution or denial of service, potentially enabling self-propagating attacks without user interaction.
Organizations should apply Microsoft’s security updates and restart affected DNS servers. Where patching cannot occur immediately, Microsoft’s registry-based mitigation can reduce exposure; defenders should also investigate anomalous dns.exe activity and DNS traffic exceeding 60,000 bytes, which may indicate exploitation attempts.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Elastic released public detection logic for SIGRed, including monitoring for suspicious dns.exe behavior and unusually large DNS traffic.
A public proof-of-concept exploit demonstrating denial of service for the SIGRed vulnerability was published.
Microsoft released security updates for CVE-2020-1350, affecting Windows DNS Server deployments on supported and legacy Windows Server versions.
The SIGRed Windows DNS Server remote code execution and denial-of-service flaw was assigned CVE-2020-1350.
Check Point Research sent its initial disclosure of the Windows DNS Server vulnerability later named SIGRed to Microsoft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has published a cluster of DNS-related security advisories covering **remote code execution, denial of service, cache poisoning, heap overflow, and access-control bypass** conditions across Windows DNS Server and third-party DNS components. The newly listed issues include `CVE-2026-33278` for possible arbitrary code execution during **DNSSEC** validation, `CVE-2026-42959` for crashes triggered by malicious DNSSEC content, `CVE-2026-42960` for possible cache poisoning through promiscuous authority-section records, and `CVE-2026-42944` for a heap overflow involving multiple `NSID`, `COOKIE`, and `PADDING` **EDNS** options. Additional advisories describe degradation-of-service conditions tied to long EDNS option lists (`CVE-2026-41292`), unbounded name compression (`CVE-2026-44390`), and a "packet of death" affecting **DNSCrypt** (`CVE-2026-32792`). The disclosures also reference flaws in widely used DNS software, including a **BIND 9** resolver unbounded resend loop (`CVE-2026-5950`), invalid handling of `CLASS != IN` (`CVE-2026-5946`), and a **CoreDNS** ACL bypass (`CVE-2026-26017`). Earlier Microsoft advisories for Windows DNS Server remote code execution, including `CVE-2021-33754` and `CVE-2021-33746`, show that DNS services remain a recurring high-impact target because they are network-exposed and central to enterprise operations. For defenders, the combined set of advisories highlights the need to prioritize patching DNS infrastructure, review exposure of DNSSEC, EDNS, and DNSCrypt features, and monitor for service instability or anomalous DNS responses that could indicate exploitation attempts.
Jun 29, 2026
A critical Windows Netlogon remote code execution flaw, tracked as **`CVE-2026-41089`**, is being actively exploited against corporate networks, with attacks targeting Windows Server domain controllers. The vulnerability can be triggered through specially crafted Netlogon requests without authentication or user interaction, potentially allowing attackers to run arbitrary code with **SYSTEM-level privileges** and escalate to full domain compromise. Microsoft patched the issue in its May 2026 Patch Tuesday release, which addressed **118 vulnerabilities**, including **16 critical** flaws, and the **Centre for Cybersecurity Belgium** flagged the Netlogon bug as a priority because of confirmed in-the-wild exploitation. Organizations are being urged to immediately patch supported Windows Server versions from 2012 onward, restrict domain controllers from untrusted network exposure, and increase monitoring for suspicious Netlogon and authentication activity while reinforcing segmentation and access controls around domain controllers.
Jun 30, 2026
Microsoft disclosed **CVE-2026-58275**, a critical missing-authorization flaw in **Azure DNS** that allowed an unauthenticated attacker to elevate privileges over the network. The vulnerability carries a **CVSS 3.1 score of 10.0** with vector `AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H` and is mapped to **CWE-862**. Because Azure DNS is a hosted cloud control-plane service, successful exploitation could have enabled unauthorized changes to DNS records, traffic redirection, service disruption, and manipulation of email routing. Microsoft said the issue was remediated with a **service-side fix** through the Microsoft Security Update Guide, and no active exploitation had been reported at the time of disclosure. Defenders were urged to review **Azure RBAC** permissions, audit recent DNS changes, enforce privileged identity protections, and enable logging and alerting for suspicious DNS modifications and role-assignment activity.
Jul 24, 2026