DHCP Client Service Remote Code Execution Vulnerability
Plan PatchCVSS 9.8CVE-2026-44815Jun 9, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A stack-based buffer overflow exists in the Windows DHCP Client service. An unauthenticated attacker can send a specially crafted DHCP response over the network to trigger the vulnerability and execute arbitrary code with system privileges on affected systems. This affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), and Windows Server (2016, 2019, 2022, 2025). All systems running DHCP clients are vulnerable. Microsoft has released security updates for all supported versions.
What this means
What could happen
A remote attacker without credentials could send a specially crafted DHCP response to a vulnerable system and execute arbitrary code with system privileges. On OT equipment running Windows, this could allow an attacker to alter control logic, modify setpoints, or disrupt critical operations like water treatment or power distribution.
Who's at risk
Any organization running Windows 10 (all versions 1607–22H2), Windows 11 (all versions 23H2–26H1), Windows Server (2016, 2019, 2022, 2025) is affected. This includes IT workstations, HMIs, engineering computers, and any Windows-based SCADA clients or data acquisition systems in water utilities, power grids, and manufacturing facilities. Any system configured to obtain an IP address via DHCP is at risk.
How it could be exploited
An attacker on the network sends a malicious DHCP response to a Windows DHCP client. The client processes the response and the buffer overflow in the DHCP service triggers, allowing the attacker to execute commands with system-level privileges on the vulnerable machine.
Prerequisites
- Network access to the DHCP client (typically UDP port 67/68 from the same network segment or DHCP relay traffic)
- Target system must be configured to use DHCP (standard on most Windows systems)
- No authentication required
Remotely exploitableNo authentication requiredLow complexity attackAffects system-level processesAll recent Windows versions vulnerableDHCP is enabled by default
Exploitability
Some exploitation risk — EPSS score 1.1%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/2Windows Server 2016
HOTFIXInstall the June 2026 Microsoft security update for your Windows version immediately. Verify your system version and install the corresponding build: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2016/2019/2022/2025.
All products
WORKAROUNDIf patches cannot be deployed immediately, restrict DHCP traffic at the network edge by blocking untrusted DHCP servers using firewall rules or DHCP snooping on network switches to prevent rogue DHCP responses from reaching Windows clients.
Long-term hardening
0/1HARDENINGReview network segmentation to ensure DHCP clients do not share the same network segment as untrusted systems or external networks.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/3e68fb78-3e0e-4603-aed9-77c092372195Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.