OTPulse

Windows DHCP Server Remote Code Execution Vulnerability

Plan PatchCVSS 8.1CVE-2026-88171Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

Double free vulnerability in Windows DHCP Server allows an unauthorized attacker to execute code over a network. Affects Windows 10 (versions 1607, 1809), Windows Server 2016, 2019, 2022, and 2025.

What this means
What could happen
An attacker on your network could send specially crafted DHCP requests to your DHCP server, running arbitrary commands with system privileges. This could allow them to modify network settings, compromise connected devices, or disrupt DHCP services that assign IP addresses to your operations network.
Who's at risk
Windows Server administrators running DHCP services, particularly those hosting DHCP servers for OT network segments (VLAN assignment, IP allocation for RTUs, PLCs, and HMIs). Affects Windows Server 2016, 2019, 2022, 2025 and Windows 10 systems acting as DHCP servers. Not a direct risk to individual workstations unless they run DHCP server role.
How it could be exploited
An attacker with network access to your DHCP server (typically port 67/UDP for DHCP) sends a malicious DHCP packet that triggers a double-free memory error in the Windows DHCP service. This memory corruption allows the attacker to execute arbitrary code with the privileges of the DHCP service (typically SYSTEM).
Prerequisites
  • Network access to DHCP server on port 67 (UDP)
  • DHCP service must be running on affected Windows version
  • No authentication or credentials required
remotely exploitableno authentication requirednetwork-accessible serviceaffects core infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.7%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5761
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33650
Windows Server 2025All versionsBuild 10.0.26100.33650
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply Microsoft October 2026 security update to all Windows Server 2016, 2019, 2022, and 2025 systems running DHCP server role
All products
HOTFIXApply Microsoft October 2026 security update to Windows 10 Version 1607 and Version 1809 systems if configured as DHCP servers
Long-term hardening
0/2
HARDENINGRestrict DHCP server access to only authorized DHCP clients by configuring DHCP Authorization in Active Directory (Windows Server environment)
HARDENINGIsolate DHCP servers on a separate management network segment with firewall rules limiting UDP port 67 access to authorized subnets only
View full vendor advisory
API: /api/v1/advisories/e2f757f9-2f6e-4a07-b31b-6508a659aeef

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.