OTPulse

Windows DHCP Server Denial of Service Vulnerability

MonitorCVSS 5.5CVE-2026-70201Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Out-of-bounds read in Windows DHCP Server allows a local authorized attacker to crash the DHCP Server service. The vulnerability affects Windows Server 2016, 2019, 2022, and 2025 (both full and Server Core installations). Exploitation is assessed as less likely. Patches are available from Microsoft for all affected versions.

What this means
What could happen
An attacker with local access to a Windows Server running DHCP could crash the DHCP Server service, causing network devices to lose IP address assignments and lose network connectivity.
Who's at risk
Water authorities and utilities running Windows Server with DHCP services should prioritize patching. This includes servers managing IP address assignment for SCADA networks, HMI systems, and engineering workstations. All Windows Server versions 2016, 2019, 2022, and 2025 are affected.
How it could be exploited
An attacker with local credentials on a Windows Server would send a specially crafted request to the DHCP Server service, triggering an out-of-bounds memory read that crashes the service. This stops DHCP from handing out IP addresses to new or renewing clients.
Prerequisites
  • Local user account on the Windows Server
  • DHCP Server role installed and running
Requires local accessLow exploit probability (0.4% EPSS)Authentication requiredAffects availability only
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5761
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33650
Windows Server 2025All versionsBuild 10.0.26100.33650
Windows Server 2016All versionsBuild 10.0.14393.9612
Windows Server 2016 (Server Core installation)All versionsBuild 10.0.14393.9612
Remediation & Mitigation
0/2
Do now
0/1
WORKAROUNDIf immediate patching is not possible, restrict local administrative access and monitor DHCP Server service for unexpected restarts
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply October 2026 Microsoft security update to Windows Server 2016, 2019, 2022, or 2025
View full vendor advisory
API: /api/v1/advisories/f3641cf2-301d-442d-a93f-bf8fcd1b6ddd

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows DHCP Server Denial of Service Vulnerability | CVSS 5.5 - OTPulse