0patch Fixes Critical Windows Server DNS Vulnerability on Older Systems

0patch has released micropatches for a critical Windows DNS Server vulnerability that allows attackers to execute malicious code remotely without authentication. The fix targets older Windows Server versions that no longer receive regular security updates from Microsoft.

The vulnerability, tracked as CVE-2026-62878, affects how Windows DNS Server handles recursive DNS queries and can lead to remote code execution.

0patch brings Microsoft’s DNS security fix to older Windows Servers

According to 0patch, the vulnerability stems from a stack-based buffer overflow that occurs when Windows DNS Server processes recursive queries.

Microsoft addressed the issue in its August 2026 Patch Tuesday updates, but systems running older, unsupported Windows Server versions remained exposed.

Microsoft’s fix limits DNS query recursion depth to 62, preventing the excessive recursion that triggers the buffer overflow.

0patch has now implemented the same protection through its micropatching technology, extending the security fix to older Windows Server installations without requiring users to install a traditional Windows update.

Unlike conventional security updates, the micropatch applies directly to running processes and does not require a system restart.

Which Windows Server versions are affected?

The micropatches cover fully updated installations of Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2. For Windows Server 2008 R2, the fix supports systems without Extended Security Updates (ESU) and those with ESU years 1 through 4.

As for Windows Server 2012 and 2012 R2, it supports installations without ESU or with ESU years 1 and 2.

These versions no longer receive regular security updates, leaving organizations that continue to operate them dependent on extended support arrangements or third-party security solutions.

Security patches are already available

0patch confirms that it has automatically distributed the micropatches to affected online systems running the 0patch Agent with active PRO or Enterprise accounts.

Administrators using these subscriptions do not need to manually download or install the fix, and the update does not interrupt server operations with a restart.

The company also provides extended security fixes for other aging Microsoft products, including Windows 10, Office 2016, Office 2019, and Office 2021. Microsoft’s Office LTSC 2021 also reached its end of support on October 13, 2026.

While 0patch offers organizations a way to protect legacy systems against newly discovered vulnerabilities, migrating to a supported Windows Server version remains the recommended long-term security approach.