Cyber Resilience

CVE-2026-86003

Published
16 September 2026
Modified
16 September 2026
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0044 37th percentile
Risk Priority 57 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-86003 is a high-severity Confused Deputy (CWE-441) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Proxy (T1090); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy used by UDP, TCP, and DNS-over-TLS. An unauthenticated client can…

more

send an RFC 2136 UPDATE that the proxy or forward plugin passes unchanged to an update-capable upstream. If that upstream trusts CoreDNS's source address or connection and does not require an attacker-unknown end-to-end TSIG, the request appears to originate from CoreDNS and can add, replace, or delete DNS records, redirect traffic, take over names, alter mail routing, or disrupt the writable zone. This issue is fixed in version 1.14.7.

CWE(s)
CWE-441

Related Threats

MITRE ATT&CK Enterprise Techniques

T1090 Proxy Command And Control
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
attack.mitre.org →
T1090.001 Internal Proxy Command And Control
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.
attack.mitre.org →
T1090.002 External Proxy Command And Control
Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.2.1
  • V3.5.1
  • V3.5.3
  • V3.5.8

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-32 System Partitioning
addresses: CWE-441

Mitigates confused deputy risks by ensuring distinct privilege domains so one partition cannot unintentionally act on behalf of another.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 partial match
prevents

Proper conveyance and verification of original identity assertions directly prevents loss of request source when forwarding.

PR.AA-05 partial match
prevents

Enforcing least-privilege authorizations on forwarded requests reduces confused-deputy abuse even if source identity is lost.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control partial match
prevents

Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.

A.5.16 Identity management partial match
prevents

Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.

A.5.18 Access rights partial match
degrades

Explicit access-rights assignment can restrict the product’s ability to act as an unintended proxy for external actors.

A.8.2 Privileged access rights partial match
degrades

Privileged-access controls limit the rights the product may exercise on behalf of upstream callers, mitigating confused-deputy abuse.

A.8.20 Networks security partial match
degrades

Network-security controls can enforce source validation and prevent the product from blindly proxying traffic to external actors.

A.8.25 Secure development life cycle partial match
prevents

Secure-SDLC practices include design reviews that detect and eliminate confused-deputy proxy patterns before deployment.

References