OTPulse

Windows DHCP Server Denial of Service Vulnerability

Plan PatchCVSS 7.5CVE-2026-77895Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

An out-of-bounds read vulnerability in the Windows DHCP Server allows an unauthenticated network attacker to cause a denial of service. The vulnerability affects Windows Server 2016, 2019, 2022, and 2025, as well as Windows 10 Version 1607 and 1809. An attacker can send a malformed DHCP packet to crash the server and disrupt DHCP service, preventing devices from obtaining IP addresses.

What this means
What could happen
An attacker on the network could crash the DHCP server by sending malformed packets, knocking it offline and preventing workstations and devices from obtaining IP addresses. This could halt operations if your facility depends on DHCP for device connectivity.
Who's at risk
Water utilities and electric utilities using Windows Server as a DHCP server in their network infrastructure. Any facility relying on DHCP to assign IP addresses to workstations, HMIs, RTUs, and control network devices should prioritize this update to avoid service disruption.
How it could be exploited
An attacker sends a specially crafted DHCP packet to port 67/udp on your DHCP server. The server reads past allocated memory bounds, crashes, and stops responding to DHCP requests. No authentication or special configuration is needed.
Prerequisites
  • Network access to port 67/udp on the DHCP server
  • DHCP server running one of the affected Windows versions
  • No authentication required
remotely exploitableno authentication requiredlow complexityaffects network availability
Exploitability
Some exploitation risk — EPSS score 1.2%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5622
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33438
Windows Server 2025All versionsBuild 10.0.26100.33438
Remediation & Mitigation
0/6
Do now
0/1
HARDENINGRestrict network access to port 67/udp on your DHCP server to only authorized management subnets
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9512 or later
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9245 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5622 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33438 or later
Long-term hardening
0/1
HARDENINGDeploy a DHCP server on the latest Windows version to replace legacy 2016/2019 systems
View full vendor advisory
API: /api/v1/advisories/28ec06ad-ba80-4fc5-843f-0d69ce83bf25

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows DHCP Server Denial of Service Vulnerability | CVSS 7.5 - OTPulse