CVE-2026-97006
A NVD · · CVE-2026-97006
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 4.9
- EPSS
- 0%
Key insight
The vulnerability requires an authorized attacker, which limits exploitability but remains relevant in case of compromised accounts or insiders.
Description
CVE-2026-97006 is a vulnerability in the Windows DNS service that allows an out-of-bounds read. An attacker with authorization can thereby disclose information over the network. Affected are Windows systems running the DNS server service. Currently, there are no indications of active exploitation or a public exploit.
Risk score
- cvss base
- 49.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 49.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational