OTPulse

DHCP Server Service Remote Code Execution Vulnerability

Plan PatchCVSS 8.8CVE-2026-50370Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A heap-based buffer overflow exists in the Windows DHCP Server service that allows an unauthenticated attacker on an adjacent network to execute arbitrary code with system privileges. The vulnerability is triggered by sending a malformed DHCP packet to a system running DHCP Server, without requiring any authentication or user interaction. Affected systems include Windows 10 (versions 1607 and 1809, both 32-bit and x64), Windows Server 2016, 2019, 2022, and 2025 (including Server Core installations).

What this means
What could happen
An attacker on your network could send a malformed DHCP request to a Windows DHCP server, causing it to execute arbitrary code and take full control of the server. This could allow an attacker to modify network configurations, intercept traffic, or disrupt DHCP services that devices depend on for network connectivity.
Who's at risk
Water authorities and municipal utilities running DHCP servers on Windows Server 2016, 2019, 2022, or 2025 systems should prioritize patching. This includes both full server installations and Server Core deployments. Windows 10 systems acting as DHCP servers are also affected. Any organization relying on these systems for network address assignment should treat this as a critical vulnerability.
How it could be exploited
An attacker on the same network segment sends a specially crafted DHCP packet to the DHCP server. The malformed packet triggers a heap buffer overflow in the DHCP Server service, allowing the attacker to execute arbitrary code with system privileges on the server.
Prerequisites
  • Attacker must have network access to the DHCP server (same network segment or routable network path)
  • DHCP Server service must be running on the target Windows system
  • No authentication or user interaction required
remotely exploitableno authentication requiredlow complexityhigh CVSS (8.8)affects network infrastructureexploitation more likely per Microsoft assessment
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (11)
11 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33158
Windows Server 2025All versionsBuild 10.0.26100.33158
Windows 10 Version 1607 for 32-bit SystemsAll versionsBuild 10.0.14393.9339
Remediation & Mitigation
0/3
Do now
0/2
HOTFIXApply Microsoft's 2026-Jul security update to all affected Windows Server and Windows 10 systems running DHCP Server service
WORKAROUNDIf immediate patching is not possible, restrict DHCP traffic (UDP port 67/68) at the network perimeter and switches to only authorized DHCP server addresses
Long-term hardening
0/1
HARDENINGSegment your network so that DHCP servers are isolated from untrusted network segments
View full vendor advisory
API: /api/v1/advisories/d8aef6de-f39f-4f19-9f06-0b37d3005898

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

DHCP Server Service Remote Code Execution Vulnerability | CVSS 8.8 - OTPulse