Windows DHCP Server CVE-2026-58627

Exploitation requires that the target host has the Windows DHCP Server role installed and enabled and that the attacker can reach it with DHCP protocol traffic (UDP 67) on a routable or shared network segment. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special configuration, and no user interaction are needed against a default DHCP deployment. The primary limiting factor is exposure: DHCP is an internal infrastructure service, so the attacker must already be on a network that can reach the server (LAN foothold, VPN, or adjacent VLAN) rather than exploiting it from the open internet; hosts without the DHCP Server role installed are unaffected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a genuinely low-barrier attack: network reachable, low complexity, no privileges, and no user interaction, with a pure high-availability impact and no confidentiality or integrity effect. This makes it a clean denial-of-service issue rather than a code-execution threat, which is why it scores 7.5 (High) rather than Critical. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of a KEV entry and any public exploit suggests this is not currently under active or widespread exploitation. Real-world priority hinges on exposure - a DHCP server is normally an internal-only role, so the 'network' vector is realistically constrained to the local/enterprise network segment rather than the open internet, which meaningfully lowers practical risk versus the raw score. Because DHCP is a critical availability dependency, however, a successful attack from any foothold on the LAN could disrupt address assignment enterprise-wide.

An attacker with a foothold on the local network - for example a compromised workstation or a rogue device plugged into an accessible port - sends a flood of crafted DHCP requests to the server on UDP 67. Because no authentication or user interaction is required and complexity is low, the server's resources are exhausted and it stops issuing or renewing leases, causing clients to lose network connectivity as their addresses expire. No public proof-of-concept has been identified at time of analysis.