Windows DHCP Server CVE-2026-50370

Exploitation requires that the target host has the Windows DHCP Server role installed and running, and that the attacker can send DHCP traffic to it from the same adjacent/local network segment (CVSS AV:A) - a remote off-link attacker cannot reach the vulnerable code path across routed boundaries without a relay or link-local foothold. No authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L), so once link-local reachability exists a single crafted DHCP message suffices. Limiting factors: the DHCP Server role must actually be enabled (it is not active on default client installs, even on the listed Windows 10 1607/1809 builds that ship the service), and network segmentation or DHCP snooping preventing untrusted hosts from reaching the server materially reduces reachability.

The signals are largely consistent and point to a genuine priority for organizations running the Windows DHCP Server role, tempered by the attack vector. CVSS 3.1 8.8 with AV:A/AC:L/PR:N/UI:N and H/H/H impact means no authentication, no user interaction, and low complexity - but critically the Adjacent (AV:A) vector, not Network, so an attacker must already sit on the same broadcast domain, which meaningfully limits mass internet-facing exploitation and pushes this toward insider, lateral-movement, or compromised-device scenarios rather than remote drive-by attacks. No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input, and the absence of KEV means there is no confirmed active exploitation. SSVC framing would likely rate technical impact as total and automatable as partial (a single crafted packet), but exploitation status is 'none' on current data. Net: patch promptly on DHCP servers since the service runs as SYSTEM, but recognize this is adjacent-network rather than pre-auth internet-wide, so existing segmentation already blunts it.

An attacker who has gained a foothold on a device in the same broadcast domain as a Windows DHCP server (for example a compromised workstation or a rogue device on an office VLAN) sends a specially crafted DHCP message that overflows a heap buffer in the server's parser. Given low attack complexity, no authentication, and no user interaction, successful exploitation yields SYSTEM-level code execution on core network infrastructure. No public exploit identified at time of analysis, so this scenario is currently theoretical rather than observed.