OTPulse

Windows DHCP Server Information Disclosure Vulnerability

MonitorCVSS 6.5CVE-2026-62745Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Integer underflow vulnerability in Windows DHCP Server allows an attacker on an adjacent network (same subnet) to disclose sensitive information from server memory. The vulnerability exists in Windows 10 (versions 1607 and 1809), Windows Server 2016, 2019, 2022, and 2025. Exploitation requires only network access to the subnet; no credentials or authentication are required.

What this means
What could happen
An attacker on the same network segment (adjacent network) could craft malformed DHCP requests to trigger an integer underflow in the Windows DHCP Server, potentially leaking sensitive information from server memory such as configuration data or other system details.
Who's at risk
This affects municipal network administrators and IT departments running Windows-based DHCP servers, particularly those on Windows Server 2016, 2019, 2022, or 2025. Water authorities and utilities using these systems for network infrastructure are at risk.
How it could be exploited
An attacker with network access to the same subnet as your DHCP server sends specially crafted DHCP protocol messages designed to trigger an integer underflow in the DHCP Server service. The underflow could cause the server to disclose portions of its memory containing sensitive configuration or system information.
Prerequisites
  • Network access to the same subnet as the DHCP server (adjacent network)
  • DHCP Server service running on Windows 10, Windows Server 2016, 2019, 2022, or 2025
no authentication requiredlow complexityinformation disclosure
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5499
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33296
Windows Server 2025All versionsBuild 10.0.26100.33296
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the 2026-Aug security update from Microsoft to all Windows 10 and Windows Server systems running DHCP Server
View full vendor advisory
API: /api/v1/advisories/6626dfd9-5a5c-449e-81be-642825a7eccf

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.