OTPulse

Windows DHCP Server Denial of Service Vulnerability

Plan PatchCVSS 7.5CVE-2026-77890Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A type confusion vulnerability in Windows DHCP Server allows an unauthenticated remote attacker to trigger a denial of service by sending a malformed DHCP request. The affected process crashes, preventing the server from assigning IP addresses to network clients. Affected versions include Windows Server 2016, 2019, 2022, and 2025, as well as Windows 10 versions 1607 and 1809.

What this means
What could happen
A remote attacker can send malformed DHCP requests to a Windows DHCP server, causing it to crash or become unresponsive. This disrupts IP address assignment to network devices, preventing new clients from connecting to your network.
Who's at risk
Organizations running Windows Server 2016, 2019, 2022, or 2025 as DHCP servers should patch immediately. This includes water utilities and electric cooperatives that use Windows DHCP for network infrastructure, as well as any IT operations relying on DHCP for device provisioning and network management.
How it could be exploited
An attacker on the network or with network access to the DHCP server (typically UDP port 67) sends a crafted DHCP packet with incorrect data types. The Windows DHCP Server process crashes due to the type confusion bug, stopping all DHCP services until the service is restarted.
Prerequisites
  • Network access to DHCP server on UDP port 67
  • DHCP service must be running on the target Windows system
remotely exploitableno authentication requiredlow complexityaffects network availability
Exploitability
Some exploitation risk — EPSS score 1.2%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5622
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33438
Windows Server 2025All versionsBuild 10.0.26100.33438
Remediation & Mitigation
0/6
Do now
0/1
WORKAROUNDRestrict network access to DHCP port 67 (UDP) to only authorized DHCP client subnets using firewall rules
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9512 or later
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9245 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5622 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33438 or later
Long-term hardening
0/1
HARDENINGIf DHCP is not required, disable the DHCP service and use static IP addressing or alternative DHCP servers
View full vendor advisory
API: /api/v1/advisories/f64a1c76-8e17-4b01-abf6-8036092c0536

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.