CVE-2026-50248

Vendor

Microsoft

Product

dnsmasq / Unbound / PowerDNS

CVSS

6.5

Exposure class

Edge / VPN / firewall

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 15
   CVE NVD 22 Jul 2026

   In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is…

   In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof…

   CVSS 6.5 CVE-2026-50248
2. 14
   Advisory MSRC 23 Jul 2026

   CVE-2026-50248 BOGUS configured primary hostname accepted for XFR in auth/rpz zones

   Information published.

   CVE-2026-50248 Microsoft