CVE-2026-72948 in Windows
Summary
by MITRE • 09/09/2026
Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability described constitutes a critical local privilege escalation flaw within the Microsoft Windows Domain Name System (DNS) service, specifically involving a relative path traversal mechanism. This type of security defect typically arises when the application fails to properly validate or canonicalize user-supplied input before using it in file system operations. In this context, an attacker who has already gained authenticated access to the local machine can manipulate directory paths to traverse outside the intended sandboxed environment. By exploiting relative path traversal, the malicious actor is able to direct write operations to arbitrary locations on the disk that are normally protected by standard operating system permissions. This capability effectively bypasses the security boundaries established for lower-privileged accounts, allowing them to overwrite critical system files or configuration data with content of their choosing.
From a technical perspective, this flaw aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-73: External Control of File Name or Path. The core issue lies in the DNS service's handling of file paths during specific operations, likely related to zone transfers, logging, or dynamic update processes where relative paths are resolved without sufficient sanitization. When an attacker provides a path containing sequences such as dot-dot-slash (..), they can navigate up the directory tree from the current working directory. If the DNS service executes these operations with elevated privileges but relies on insecure path resolution logic, it may inadvertently write to sensitive system directories like System32 or registry hives. This misconfiguration allows a standard user account to perform actions reserved for administrators, fundamentally breaking the principle of least privilege that underpins modern operating system security models.
The operational impact of this vulnerability is severe, as it facilitates unauthorized local privilege escalation from a low-privileged user context to SYSTEM-level access. Once an attacker achieves SYSTEM privileges, they gain complete control over the affected Windows host. This level of access enables the installation of rootkits, theft of sensitive data stored on the machine, modification or deletion of system logs to cover tracks, and further lateral movement within the network infrastructure. In enterprise environments where DNS servers are often highly privileged assets due to their central role in name resolution and Active Directory integration, this vulnerability poses a significant risk to overall organizational security posture. It effectively neutralizes many perimeter defenses because an attacker only needs initial low-level access to compromise the entire system.
This behavior is also consistent with techniques observed in the MITRE ATT&CK framework, particularly under T1068: Exploitation for Privilege Escalation and potentially T1547: Boot or Logon Autostart Execution if the attacker uses the elevated privileges to persist on the system. The exploitation chain typically involves identifying a writable location via path traversal, crafting malicious content such as a DLL or executable, and triggering the DNS service to load or write this content in a privileged context. To mitigate this risk, organizations must ensure that all Windows systems are patched with the latest security updates provided by Microsoft, which address these specific input validation flaws within the DNS service components. Additionally, implementing strict file system permissions and monitoring for unusual path traversal patterns in application logs can help detect attempted exploitation activities before they result in a full compromise.