Windows DHCP Server CVE-2026-69497

Exploitation requires network-level access to the Windows DHCP Server service and low-privilege authentication - Microsoft explicitly characterizes the attacker as 'authorized,' indicating domain credentials or equivalent authenticated access are a prerequisite. The Windows DHCP Server role must be actively installed and running on the target system; this role is not present in default Windows Server installations and must be deliberately deployed. No user interaction is required once network access and credentials are obtained. Exploitation is limited by the authentication barrier: unauthenticated or anonymous attackers cannot trigger the flaw, and the impact is confined to availability (no data exfiltration or code execution).

The provided CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: network-reachable, low complexity, but gated by low-privilege authentication, with impact confined to availability. No EPSS data is supplied, no KEV listing exists, and no public PoC is known, indicating this is not under active widespread exploitation. Real-world risk is moderate-to-elevated for organizations where DHCP is a single point of failure: any authenticated domain user could trigger the leak, and DHCP outages cascade to network connectivity loss for all clients. The 'authorized attacker' framing limits opportunistic exploitation to credential-holding insiders or attackers who have already compromised a domain account. The absence of confidentiality and integrity impact keeps severity moderate despite the broad version scope.

A domain-authenticated user or attacker with stolen low-privilege credentials sends a repeated stream of specially crafted DHCP request packets to the Windows DHCP Server over the network, triggering the allocation-without-free code path on each request. Over minutes to hours, the DHCP service process exhausts available server memory, causing the service to crash and interrupt IP lease assignment for all network clients. No public PoC is known, but the low attack complexity (AC:L) suggests the triggering condition would be straightforward to reproduce once identified.