cbcvebase.
CVE-2021-26894
published 2021-03-11

CVE-2021-26894: Windows DNS Server Remote Code Execution Vulnerability

PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
6.77%
93.2th percentile
Windows DNS Server Remote Code Execution Vulnerability

Affected

25 ranges
VendorProductVersion rangeFixed in
microsoftwindows_server_2008
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.0.0 < publicationpublication
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.0 < publicationpublication
microsoftwindows_server_2008_service_pack_2>= 6.0.0 < publicationpublication
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.0 < publicationpublication
microsoftwindows_server_2012_r2>= 6.3.0 < publicationpublication
microsoftwindows_server_2016
microsoftwindows_server_2016
microsoftwindows_server_2016
microsoftwindows_server_2016>= 10.0.0 < publicationpublication
microsoftwindows_server_2019>= 10.0.0 < publicationpublication
microsoftwindows_server_version_2004>= 10.0.0 < publicationpublication
microsoftwindows_server_version_20h2>= 10.0.0 < publicationpublication
msrcwindows_server_2008_for_32-bit_systems_service_pack_2
msrcwindows_server_2008_for_x64-based_systems_service_pack_2
msrcwindows_server_2008_r2_for_x64-based_systems_service_pack_1
msrcwindows_server_2012
msrcwindows_server_2012_r2
msrcwindows_server_2016
msrcwindows_server_2019
msrcwindows_server_version_1909
msrcwindows_server_version_2004
msrcwindows_server_version_20h2

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability is only exploitable if the server is configured to be a DNS server — scope detection/hunting to systems with the DNS Server role enabled.
  • A prerequisite for exploitation is that dynamic updates are enabled on the DNS server — audit DNS zones for dynamic update configuration as a detection/exposure signal.
  • ·Secure Zone Updates constrains attack sources but does NOT fully prevent exploitation; it should not be treated as a complete mitigation.
  • ·Both Active Directory-integrated DNS servers and standalone DNS Primary Authoritative Servers are affected — configuration type does not determine exposure.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_msrc9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.