All advisories
CVE-2026-119905Medium · 4.9
CVE-2026-119905
Microsoft / Windows Server 2016
Official facts
- CVE published
- 10/11/2026
- Added to CISA KEV
- —
- EPSS · 14/11/2026
- 1.12%
- Confirmed exploitation
- Unknown
Original description
Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network.
Source material is displayed in its original language. EPSS estimates exploitation probability over the next 30 days; it is not evidence of an attack. An unknown score is not a low score.
Source-recommended action
Consult the official advisory and vendor instructions before applying mitigations.
Applicability depends on product, version and configuration. Verify affected versions using the official references.