Windows DHCP Server Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-70066Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
Use after free vulnerability in Windows DHCP Server allows an authorized local attacker to elevate privileges. The vulnerability requires local access and low-level user credentials.
What this means
What could happen
An attacker with local user access to a server running DHCP could gain administrator-level privileges, allowing them to modify network configurations, alter DHCP address assignments, or compromise other systems on the network.
Who's at risk
This affects Windows Server administrators who operate DHCP servers for network address management. It impacts Windows Server 2016, 2019, 2022, and 2025 installations (both full and Server Core), as well as Windows 10 systems that may be misconfigured to run DHCP Server. Utilities operating centralized DHCP infrastructure for their plant networks are at risk.
How it could be exploited
An attacker must first gain local user-level access to a Windows system running DHCP Server (typically a Windows Server). They would then exploit the use-after-free vulnerability in the DHCP service to escalate to administrator privileges, enabling full control of the DHCP service and network configuration functions.
Prerequisites
- Local user account on the affected system
- Windows DHCP Server service running and enabled
- Low privileges sufficient to interact with DHCP service APIs
requires local accesslow complexityaffects network infrastructure serviceprivilege escalation capability
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDIf DHCP Server is not required, disable the DHCP Server service and set it to manual start
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply October 2026 security update to Windows Server 2016, 2019, 2022, and 2025
Long-term hardening
0/1HARDENINGRestrict local administrative account access and implement principle of least privilege for user accounts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/ef7be69f-d9df-4919-8626-fc75d16308d6Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.