Windows DHCP Client Remote Code Execution Vulnerability
Plan PatchCVSS 8.8CVE-2026-70250Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Use-after-free vulnerability in Windows DHCP Client allows an unauthorized attacker to execute arbitrary code over an adjacent network. Affects Windows Server 2016, 2019, 2022, and 2025 (including Server Core installations). Exploitation is considered less likely. Vendor fixes are available for all affected versions.
What this means
What could happen
An attacker on your local network (not the internet) could run arbitrary code on Windows servers with administrative privileges, potentially taking control of the system and any connected OT networks.
Who's at risk
Windows Server administrators should prioritize this if their servers run on network segments where untrusted devices or visitors can connect (including guest networks, contractor access, or unsegmented OT/IT boundaries). Risk is lower for servers on fully controlled, air-gapped, or strictly segmented networks.
How it could be exploited
An attacker on the same network segment sends malformed DHCP responses to the Windows server's DHCP client. The use-after-free vulnerability in the DHCP client processor allows the attacker to execute arbitrary code with the privileges of the DHCP service.
Prerequisites
- Attacker must be on the same local network segment (adjacent network)
- DHCP client must be active on the target Windows server
- No authentication required
remotely exploitable (adjacent network)no authentication requiredlow complexityhigh CVSS score (8.8)affects Windows servers used in OT environments
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1HARDENINGIf immediate patching is not possible, isolate Windows servers from untrusted network segments using network segmentation
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the 2026-October security update to all Windows Server systems listed above
Long-term hardening
0/1HARDENINGMonitor network traffic for suspicious DHCP responses from unknown sources on your network segments
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/65ad6b7d-badc-4b90-80c2-cfd3ae04d1f4Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.