OTPulse

Windows DHCP Server Remote Code Execution Vulnerability

Plan PatchCVSS 8.1CVE-2026-69510Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

A stack-based buffer overflow vulnerability in Windows DHCP Server allows an unauthorized attacker to execute code over the network by sending a specially crafted DHCP request. The vulnerability affects Windows 10 versions 1607 and 1809, and Windows Server versions 2016, 2019, 2022, and 2025. Microsoft has released security updates for all affected versions.

What this means
What could happen
An attacker could exploit a buffer overflow in Windows DHCP Server to run arbitrary code on your server, potentially disrupting network services or gaining control of systems that depend on DHCP for IP address assignment.
Who's at risk
Water utilities and municipal electric departments that run Windows DHCP Servers (typically on Windows Server 2016, 2019, 2022, or 2025) for network management. This affects any organization where DHCP is critical to assigning IP addresses to workstations, HMIs, or network devices.
How it could be exploited
An attacker sends a specially crafted DHCP request over the network to a Windows DHCP Server. The malformed packet triggers a stack buffer overflow in the DHCP service, allowing the attacker to execute arbitrary code with DHCP service privileges.
Prerequisites
  • Network access to UDP port 67 (DHCP)
  • Windows DHCP Server role enabled on target
  • No authentication required
remotely exploitableno authentication requiredlow complexityaffects network availability
Exploitability
Unlikely to be exploited — EPSS score 0.7%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5622
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33438
Windows Server 2025All versionsBuild 10.0.26100.33438
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the September 2026 Microsoft security update to all affected Windows Server and Windows 10 systems running DHCP Server role
View full vendor advisory
API: /api/v1/advisories/c858bcec-054e-43c3-bd1b-66bd13e86f29

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows DHCP Server Remote Code Execution Vulnerability | CVSS 8.1 - OTPulse