OTPulse

Windows DHCP Server Remote Code Execution Vulnerability

Plan PatchCVSS 8.8CVE-2026-70069Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker with valid network admin credentials to execute code over the network by sending a specially crafted DHCP message. Affected versions include Windows Server 2016, 2019, 2022, 2025, and Windows 10 Version 1607 and 1809.

What this means
What could happen
An attacker with valid network admin credentials could exploit a buffer overflow in the DHCP Server service to run arbitrary commands on your Windows Server, potentially disrupting network operations or gaining control of critical infrastructure systems.
Who's at risk
Windows Server administrators operating DHCP servers in Windows Server 2016, 2019, 2022, or 2025 environments. Also affects Windows 10 systems running DHCP Server service. Municipal utilities using Windows-based DHCP for network infrastructure management should prioritize patching.
How it could be exploited
An attacker with engineer or network admin credentials sends a specially crafted DHCP protocol message to port 67/68 on a Windows Server running DHCP Server service. The malformed packet triggers a stack buffer overflow in the DHCP service, allowing the attacker to execute arbitrary code with DHCP service privileges.
Prerequisites
  • Network access to DHCP Server (port 67/68)
  • Valid network administrator or equivalent credentials
  • Windows Server 2016, 2019, 2022, 2025, or Windows 10 running DHCP Server service
Remotely exploitableRequires valid administrator credentialsAffects network infrastructureBuffer overflow vulnerability
Exploitability
Unlikely to be exploited — EPSS score 0.9%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5761
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33650
Windows Server 2025All versionsBuild 10.0.26100.33650
Remediation & Mitigation
0/6
Do now
0/1
WORKAROUNDRestrict network access to DHCP Server ports (67/68) to authorized administrative networks only via firewall rules
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
Long-term hardening
0/1
HARDENINGDisable DHCP Server role on systems that do not require it
View full vendor advisory
API: /api/v1/advisories/e04bcb65-f224-4598-90b5-f14d7c8ff5c2

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows DHCP Server Remote Code Execution Vulnerability | CVSS 8.8 - OTPulse