OTPulse

Windows DHCP Server Denial of Service Vulnerability

Plan PatchCVSS 7.5CVE-2026-77888Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A type confusion vulnerability in Windows DHCP Server allows an unauthorized attacker to cause a denial of service by sending malformed DHCP packets over the network. The vulnerability affects Windows 10 and Windows Server 2016 through 2025. Successful exploitation causes the DHCP Server service to crash, preventing clients from obtaining IP address leases. The attack requires no authentication and can be triggered remotely.

What this means
What could happen
An attacker can send specially crafted network packets to a Windows DHCP Server, causing it to crash and stop assigning IP addresses to devices on your network. This can disrupt communication across plant equipment and workstations.
Who's at risk
Water authorities and utilities using Windows Server as a DHCP Server for network infrastructure should prioritize patching. Affects Windows Server 2016, 2019, 2022, and 2025 installations that run DHCP services.
How it could be exploited
An attacker on the network sends a malformed DHCP request packet exploiting a type confusion flaw in the DHCP Server process. The server crashes without requiring authentication, preventing DHCP lease allocation for any client.
Prerequisites
  • Network access to the DHCP Server (port 67/68 UDP typically)
  • DHCP Server service running on a Windows 10 or Windows Server system
remotely exploitableno authentication requiredlow complexity
Exploitability
Some exploitation risk — EPSS score 1.2%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5622
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33438
Windows Server 2025All versionsBuild 10.0.26100.33438
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict DHCP Server network access using firewall rules to limit incoming traffic on ports 67/68 to only authorized devices
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXApply Microsoft September 2026 security update to Windows Server 2019 and Windows Server 2022 (or Windows 10 if used as DHCP)
Long-term hardening
0/1
HARDENINGSegment the DHCP Server on a dedicated network subnet away from untrusted or guest networks
View full vendor advisory
API: /api/v1/advisories/c0f04e48-61c7-454d-bc15-b3731d4b7d5f

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows DHCP Server Denial of Service Vulnerability | CVSS 7.5 - OTPulse