← Back

CVE-2026-49174

nvd nist
Published: Jul 14, 2026Modified: Jul 22, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Exploitability: 1.8 / Impact: 4.2
Source: secure@microsoft.com (Secondary)

Description

Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

Affected (17)

Microsoft
9 products
Windows 10 1809
Windows 10 21h2
Windows 10 22h2
Windows 11 24h2
Windows 11 25h2
Windows 11 26h1
Windows Server 2019
Windows Server 2022
Windows Server 2025
Configuration A
17 vulnerable
Vulnerable SoftwareAffected Versions
Microsoft
Windows 10 1809
version < 10.0.17763.9020
Windows 10 1809
version < 10.0.17763.9020
Microsoft
Windows 10 21h2
version < 10.0.19044.7548
Windows 10 21h2
version < 10.0.19044.7548
Windows 10 21h2
version < 10.0.19044.7548
Microsoft
Windows 10 22h2
version < 10.0.19045.7548
Windows 10 22h2
version < 10.0.19045.7548
Windows 10 22h2
version < 10.0.19045.7548
Microsoft
Windows 11 24h2
version < 10.0.26100.8875
Windows 11 24h2
version < 10.0.26100.8875
Microsoft
Windows 11 25h2
version < 10.0.26200.8875
Windows 11 25h2
version < 10.0.26200.8875
Microsoft
Windows 11 26h1
version < 10.0.28000.2525
Windows 11 26h1
version < 10.0.28000.2269
Windows Server 2019
version < 10.0.17763.9020
Windows Server 2022
version < 10.0.20348.5386
Windows Server 2025
version < 10.0.26100.33158

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

Source: secure@microsoft.com
PatchVendor Advisory

Timeline

No history available yet.