Windows DHCP Server Remote Code Execution Vulnerability
Plan PatchCVSS 8.1CVE-2026-69830Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary
A race condition vulnerability in Windows DHCP Server allows an unauthorized attacker to execute code over a network by exploiting improper synchronization of concurrent requests. The vulnerability affects Windows Server 2016, 2019, 2022, 2025, and Windows 10 Version 1607 and 1809. An attacker can leverage this flaw to gain code execution with system privileges on the DHCP server.
What this means
What could happen
An attacker on your network could execute arbitrary code on a Windows DHCP server by exploiting a race condition during concurrent DHCP requests, potentially compromising network services and affecting all devices that rely on IP address allocation.
Who's at risk
Any organization running Windows Server 2016, 2019, 2022, or 2025 with the DHCP Server role enabled. This includes water utilities and power companies that use Windows servers for network infrastructure, as well as any facility relying on these servers for IP address assignment to industrial control devices, SCADA systems, or network-connected equipment.
How it could be exploited
An attacker sends specially crafted concurrent DHCP requests to a vulnerable Windows DHCP server. The race condition in the shared resource handler allows the attacker's code to execute during the synchronization gap between request processing threads, gaining code execution on the DHCP server with system-level privileges.
Prerequisites
- Network access to DHCP server port 67/UDP (DHCP requests)
- Target must be running a vulnerable version of Windows Server 2016, 2019, 2022, 2025, or Windows 10 with DHCP Server role enabled
- Attacker must be able to send network traffic that reaches the DHCP server
remotely exploitableno authentication requiredaffects network infrastructure servicesDHCP compromise could impact all networked devices
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/5
Do now
0/1WORKAROUNDRestrict network access to DHCP server port 67/UDP to only authorized network segments and devices that require DHCP services
Schedule — requires maintenance window
0/4Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/f21f11de-1edd-4bb0-ac0a-00ba54f00930Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.