What is the CVSS score of CVE-2026-45602?

CVE-2026-45602 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Windows DHCP Server are affected by CVE-2026-45602?

Windows DHCP Server deployments face an unpatched critical vulnerability (CVE-2026-45602, CVSS 9.1) that enables remote network-level attacks without authentication or user interaction-attackers can…. A patch is available.

How to fix or mitigate CVE-2026-45602?

Within 24 hours: Inventory all Windows servers with DHCP Server role enabled and implement firewall ACLs restricting DHCP traffic to authorized management networks only. Within 7 days: Deploy network segmentation and VLAN isolation to isolate DHCP services from untrusted network segments, and enable DHCP snooping on network switches. Within 30 days: Monitor Microsoft security advisories for patch availability and establish change management procedures for immediate deployment once released.

Windows DHCP Server CVE-2026-45602

EUVD-2026-35562 CRITICAL

Improper Handling of Values (CWE-229)

2026-06-09 secure@microsoft.com

GHSA-9g25-jr9m-x4jh

Authentication Bypass Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

9.1

CVSS 3.1 · Vendor: microsoft

Temporal: 7.9

Severity by source

Vendor (microsoft) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CIRCL (temporal)

7.9 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:10 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

CRITICAL 9.1

DescriptionCVE.org

No cwe for this issue in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network.

AnalysisAI

Remote tampering in Microsoft Windows DHCP Server allows unauthenticated network attackers to manipulate critical data with high confidentiality and integrity impact, as reflected by the 9.1 CVSS score. The vulnerability is reachable over the network without privileges or user interaction, and no public exploit identified at time of analysis. The combination of authentication bypass tagging and DHCP's role as a core network infrastructure service makes this a high-priority issue for any Windows environment running the DHCP Server role.

Technical ContextAI

Windows DHCP Server is the Microsoft implementation of the Dynamic Host Configuration Protocol (RFC 2131) service shipped with Windows Server, responsible for assigning IP addresses, gateways, DNS servers, and other network parameters to clients via UDP ports 67/68. The CVE description notes 'No cwe for this issue' and the CWE field is N/A, so the precise root-cause weakness class (e.g., improper authentication, input validation, or access control) is not provided by Microsoft in the public advisory. The 'Authentication Bypass' tag combined with the CVSS PR:N attribute suggests the flaw permits actions against DHCP server state - leases, scopes, or option configuration - without the credentials normally required to administer or update server records.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45602 to all Windows Server hosts running the DHCP Server role, prioritizing internet-adjacent and multi-tenant environments first. As a compensating control where immediate patching is not possible, restrict access to DHCP server UDP ports 67/68 and any DHCP failover/management interfaces to known client VLANs and admin subnets via firewall or VLAN ACLs, accepting that overly aggressive filtering can break lease renewals for legitimate clients on adjacent segments. Consider enabling DHCP audit logging and monitoring for anomalous scope, reservation, or option changes; if a non-Microsoft DHCP service is available, temporarily failing over to it on isolated segments is an option but carries operational risk during cutover.