Windows DHCP Server Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-83691Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A heap-based buffer overflow in Windows DHCP Server allows a local authorized user to elevate privileges to SYSTEM level. The vulnerability requires local logon access and does not allow remote exploitation.
What this means
What could happen
A user with local access to a Windows server running DHCP could exploit a memory flaw to gain system-level control, allowing them to modify DHCP configurations or interrupt network operations for all devices relying on that DHCP server.
Who's at risk
Water utilities and municipal electric utilities operating Windows-based DHCP servers on Windows Server 2016, 2019, 2022, 2025 or Windows 10/11 workstations. This affects any organization using these systems to manage IP address allocation for operational technology networks.
How it could be exploited
An attacker with local logon access to a Windows DHCP server runs code that triggers a heap buffer overflow in the DHCP service. This overflow allows the attacker to overwrite memory and execute arbitrary code with SYSTEM privileges, gaining full control of the DHCP service and the configurations it manages.
Prerequisites
- Local user account access to a Windows system running DHCP Server
- No remote exploitation possible; attacker must have login capability to the machine
Requires local account access (not remotely exploitable)Low complexity attack if attacker has logon accessAffects all Windows versions listedLow EPSS score suggests exploitation is unlikely in wild
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1HARDENINGRestrict local logon access to DHCP servers to only authorized IT administrators
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2022
HOTFIXInstall the October 2026 Windows security update or later matching your Windows version (e.g., Build 10.0.20348.5761 for Windows Server 2022, Build 10.0.19045.7807 for Windows 10 22H2)
Long-term hardening
0/1HARDENINGApply principle of least privilege: disable or restrict interactive logon sessions on dedicated DHCP servers
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/13569e30-4960-49ee-bcda-17e91df713c6Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.