OTPulse

Windows DHCP Client Remote Code Execution Vulnerability

Plan PatchCVSS 7CVE-2026-61361Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A use-after-free vulnerability exists in the Windows DHCP Client that allows an authorized local user to execute arbitrary code with elevated privileges. The vulnerability affects Windows Server 2025 and Windows 11 versions 24H2, 25H2, and 26H1 across ARM64 and x64 architectures. Microsoft has released fixes in the August 2026 security update.

What this means
What could happen
A user with local access to a Windows computer could exploit a use-after-free flaw in the DHCP client to run arbitrary code with elevated privileges, potentially compromising the system and any connected networks or operational systems it manages.
Who's at risk
IT staff and system administrators who manage Windows 11 and Windows Server 2025 systems, particularly those using these operating systems on engineering workstations, OT network monitoring stations, or historian servers that interact with industrial control systems.
How it could be exploited
An attacker with local login access to a Windows machine could trigger a use-after-free condition in the DHCP client component by crafting specific network or system calls, allowing code execution in the DHCP client process context.
Prerequisites
  • Local login access to the Windows system
  • Ability to interact with or trigger DHCP client processing
Requires local access (limits immediate risk from external attackers)Requires user privilegesModerate complexity exploitationAffects widely deployed operating systems
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33296
Windows 11 Version 25H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 24H2 for ARM64-based SystemsAll versionsBuild 10.0.26100.9106
Windows 11 Version 24H2 for x64-based SystemsAll versionsBuild 10.0.26100.9168
Windows Server 2025All versionsBuild 10.0.26100.33296
Windows 11 version 26H1 for x64-based SystemsAll versionsBuild 10.0.28000.2704
Windows 11 Version 26H1 for ARM64-based SystemsAll versionsBuild 10.0.28000.2704
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the August 2026 security update from Microsoft to all affected Windows systems
Long-term hardening
0/2
HARDENINGRestrict local login to Windows computers to authorized users only; review and disable unnecessary local accounts
HARDENINGEnable Windows security audit logging for local login attempts and process creation to detect suspicious activity
View full vendor advisory
API: /api/v1/advisories/8e91c672-89a5-49cc-98cc-41ceed8777bf

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows DHCP Client Remote Code Execution Vulnerability | CVSS 7 - OTPulse