GoKawiil0patch issues micropatches for DNS flaw CVE-2026-62878 on unsupported Windows Server
Acros Security's 0patch service released micropatches fixing CVE-2026-62878, a remote code execution vulnerability in the Windows DNS Server service, for Windows Server versions that no longer receive official Microsoft updates. Microsoft had already patched the flaw in supported editions in August 2026 by capping DNS query recursion nesting depth at 62, and 0patch used a public proof-of-concept exploit credited to researchers Nicolas Alejandro Malizia and Joaquín Grassi to build equivalent fixes for legacy systems.
GoKawiil's interpretation of the reporting above, not reported fact.
The patch highlights how many organizations continue running end-of-life Windows Server systems in critical infrastructure despite Microsoft ending security support, creating a gap that third-party services like 0patch aim to fill. Because micropatches apply in memory without reboots or full updates, they could let administrators close severe remote-execution holes faster, though reliance on unofficial patches for unsupported software carries its own risk considerations.
- 0patch released micropatches for CVE-2026-62878, a DNS Server remote code execution flaw, on unsupported Windows Server versions.
- The flaw allows unauthenticated attackers to trigger memory corruption remotely; Microsoft fixed it in supported editions in August 2026.
- 0patch's fix mirrors Microsoft's approach, limiting DNS query recursion depth, but is delivered as a live in-memory patch requiring no reboot.
Source: techspot.com — Alfonso Maruccia, 2026-10-15
Published there as: “Micropatching service 0patch releases new security fixes for ancient Windows Server versions”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.