Windows DHCP Server Remote Code Execution Vulnerability
MonitorCVSS 6.6CVE-2026-85841Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredHigh
ComplexityHigh
User InteractionNone needed
Summary
Use-after-free vulnerability in Windows DHCP Server allows an authorized attacker with administrative privileges to execute arbitrary code over the network via a crafted request. The vulnerability affects Windows 10 (versions 1607 and 1809) and Windows Server 2016, 2019, 2022, and 2025. Exploitation is assessed as less likely and requires high technical complexity. Patches are available from Microsoft.
What this means
What could happen
An authorized attacker with administrative privileges on your DHCP server could execute arbitrary code on the server by sending a crafted network request. This could allow an attacker to compromise the server, gain control over IP address allocation, or pivot to other critical network infrastructure.
Who's at risk
Organizations running Windows Server 2016, 2019, 2022, or 2025 as DHCP servers should prioritize this update. Water utilities, municipalities, and industrial facilities relying on these servers for network infrastructure and potentially IP address allocation for operational technology devices should apply the patch during scheduled maintenance windows.
How it could be exploited
An attacker must first have administrative credentials or access to administer the DHCP server. They then craft a malicious network request that triggers a use-after-free memory condition in the DHCP Server service, allowing code execution with DHCP service privileges. Successful exploitation is difficult due to the high complexity required to construct the payload.
Prerequisites
- Administrative privileges on the Windows DHCP server or ability to authenticate with high-privilege account
- Network connectivity to the DHCP server
- High technical complexity required to craft exploit payload
remotely exploitablerequires high privilege credentialslow exploit probability (0.7% EPSS)high complexity exploitationaffects network infrastructure
Exploitability
Unlikely to be exploited - EPSS score 0.7%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/8
Schedule - requires maintenance window
0/7Patching may require device reboot, plan for process interruption
Windows Server 2019
HOTFIXUpdate Windows Server 2019 (all installations) to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 (all installations) to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 (all installations) to Build 10.0.26100.33650 or later
Windows Server 2016
HOTFIXUpdate Windows Server 2016 (all installations) to Build 10.0.14393.9612 or later
All products
HOTFIXUpdate Windows 10 Version 1809 32-bit systems to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 1809 64-bit systems to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 1607 32-bit systems to Build 10.0.14393.9612 or later
Long-term hardening
0/1HARDENINGRestrict DHCP server administrative access to only trusted personnel and monitor for suspicious administrative activity
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/4d3e9ac9-36ef-40bf-9552-a04f7db2a172Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.