OTPulse

Windows DHCP Server Remote Code Execution Vulnerability

MonitorCVSS 6.4CVE-2026-77891Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredHigh
ComplexityHigh
User InteractionNone needed
Summary

An out-of-bounds read vulnerability in Windows DHCP Server allows an authorized local attacker with administrative privileges to execute arbitrary code. The vulnerability affects Windows Server 2016, 2019, 2022, 2025 and Windows 10 versions 1607 and 1809. Successful exploitation could allow an insider or compromised admin account to run commands with system privileges on the DHCP server.

What this means
What could happen
An attacker with local administrative access to a Windows server running DHCP services could execute arbitrary code on that server, potentially compromising network connectivity and DHCP operations.
Who's at risk
System administrators and IT operations staff managing Windows DHCP servers in utilities and municipal networks. Affected systems include Windows Server 2016, 2019, 2022, 2025 and Windows 10 (versions 1607 and 1809). DHCP services are critical for IP address management across control system networks and business systems.
How it could be exploited
An authorized attacker with local administrator credentials exploits an out-of-bounds read vulnerability in the Windows DHCP Server service. By crafting a malicious local request, they can execute arbitrary code with system privileges.
Prerequisites
  • Local administrator credentials on the affected Windows server
  • Direct local access or remote access via RDP/remote management
  • Windows DHCP Server service running
Requires local administrator credentialsLow exploit probability (0.2% EPSS)Not currently actively exploitedMedium severity
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5622
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33438
Windows Server 2025All versionsBuild 10.0.26100.33438
Remediation & Mitigation
0/7
Schedule — requires maintenance window
0/6

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXUpdate Windows Server 2019 and Server Core to Build 10.0.17763.9245 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 and Server Core to Build 10.0.20348.5622 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 and Server Core to Build 10.0.26100.33438 or later
Windows Server 2016
HOTFIXUpdate Windows Server 2016 and Server Core to Build 10.0.14393.9512 or later
All products
HOTFIXUpdate Windows 10 Version 1809 (32-bit and x64) to Build 10.0.17763.9245 or later
HOTFIXUpdate Windows 10 Version 1607 (32-bit and x64) to Build 10.0.14393.9512 or later
Long-term hardening
0/1
HARDENINGRestrict local administrator account access to DHCP servers to only authorized personnel
View full vendor advisory
API: /api/v1/advisories/d923d87e-2373-4461-a866-3fae3f88e2b0

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows DHCP Server Remote Code Execution Vulnerability | CVSS 6.4 - OTPulse