Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated DHCP traffic with low complexity yields AV:N/AC:L/PR:N/UI:N; pure availability loss gives A:H with C/I:N.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in the Microsoft Windows DHCP Server role allows a remote, unauthenticated attacker to exhaust server resources and knock the service offline over the network. The flaw affects a broad range of supported Windows Server releases (2012 through 2025, including Server Core installations) and carries a CVSS 7.5 rating driven entirely by availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
The affected component is the DHCP Server service, a core network infrastructure role that dynamically assigns IP addresses and network configuration to clients via the DHCP protocol (UDP ports 67/68). The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the service fails to properly bound the CPU, memory, or handle resources consumed when processing attacker-supplied DHCP traffic; a crafted stream or malformed request can drive resource usage until the service can no longer respond to legitimate lease requests. CPE data confirms this is Microsoft's server-side DHCP implementation shipped across Windows Server 2012, 2012 R2, 2016, 2019 (plus their Server Core variants) and, per the tag list, Server 2022 and 2025, as well as the DHCP components in Windows 10 Version 1607 and 1809.
RemediationAI
Apply the Microsoft security update for CVE-2026-58627 via the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58627; patch status is 'Patch available per vendor advisory,' though no single fixed build number is given in the input, so consult the advisory for the exact KB per OS version. Prioritize patching internet- or perimeter-adjacent DHCP servers first, then internal ones. As compensating controls until patched, restrict UDP 67/68 reachability to trusted VLANs and management networks using firewall or router ACLs (side effect: none for legitimate clients if scoped correctly, but misconfiguration can break DHCP for valid subnets), enable DHCP snooping and rate limiting on switches to throttle abusive request volumes (side effect: aggressive limits may drop bursts during mass client boot storms), and ensure a redundant/failover DHCP server is available so a single service exhaustion does not cause a network-wide outage.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-44308
GHSA-v2gx-jj2v-qjcg