CVE-2026-628789.8CriticalCWE-121
CVE-2026-62878: Microsoft Windows Server 2012 vulnerability
Microsoft · Windows Server 2012
Vendor fix available · Affected: Microsoft Windows Server 2012 · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub24 Sep
- Not established: not seen
1.0%probability of exploitation in the next 30 days
62nd percentile
050100
Higher than 62% of scored CVEs
9.8CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.
What changed
- PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub
Coverage4 articles · 4 outlets
One row per outlet, in order of first report. First in our coverage: SANS ISC, 11 Aug.
Quiet for 9 weekslast report 9 Sep4 articles4 outlets
- Tue 11 Aug, 20:11 UTC. SANS ISC, first report. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th).
- Tue 11 Aug, 22:32 UTC. Dark Reading, its first report on the story. Microsoft's Patch Tuesday Deluge Continues With August Updates.
- Wed 12 Aug, 07:31 UTC. Security Affairs, its first report on the story. Microsoft patches wormable DNS flaw and critical WinSock zero day.
- Wed 9 Sep, 10:00 UTC. Infosecurity, its first report on the story. Microsoft Patches Record 974 CVEs Amid Exploited Windows Zero-Days.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 11 Aug 20:11 | SANS ISC | Microsoft Patch Tuesday August 2026, (Tue, Aug 11th) |
| 11 Aug 22:32 | Dark Reading | Microsoft's Patch Tuesday Deluge Continues With August Updates |
| 12 Aug 07:31 | Security Affairs | Microsoft patches wormable DNS flaw and critical WinSock zero day |
| 9 Sep 10:00 | Infosecurity | Microsoft Patches Record 974 CVEs Amid Exploited Windows Zero-Days |
- Microsoft Patches Record 974 CVEs Amid Exploited Windows Zero-DaysInfosecurity · mentions it in passing
- Microsoft patches wormable DNS flaw and critical WinSock zero daySecurity Affairs · mentions it in passing
- Microsoft's Patch Tuesday Deluge Continues With August UpdatesDark Reading · mentions it in passing
- Microsoft Patch Tuesday August 2026, (Tue, Aug 11th)SANS ISC · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.