Windows DHCP Server CVE-2026-69547

Exploitation requires: (1) network connectivity to a host running the Windows DHCP Server role (UDP/67 or related management port), and (2) low-level authenticated/authorized network access - the CVSS PR:L designation and the description's use of 'authorized attacker' indicate some form of credential or authorization is required, though the exact mechanism is not specified in the provided data. The DHCP Server role must be installed and running on the target; it is a role-on-demand feature not active by default on all Windows Servers. No user interaction is required once network access and the authorization condition are satisfied. The attack is limited to Windows Server editions where the DHCP Server role is available; the presence of Windows 10 versions in the affected list is anomalous and should be verified against the full Microsoft advisory before assuming exposure on workstation deployments.

The CVSS 8.8 score accurately reflects the real-world risk profile: network-reachable, low-complexity, with full C/I/A impact. The PR:L requirement (authorized/low-privilege attacker) is the primary limiting factor - exploitation is not fully unauthenticated, which reduces opportunistic mass exploitation risk compared to a PR:N flaw. However, in typical enterprise environments, many users or machine accounts have network access to DHCP infrastructure, making the bar for 'low privilege' potentially reachable for internal adversaries or attackers who have established a foothold. No EPSS score was provided in the input data, and this CVE does not appear in the CISA KEV catalog at time of analysis, suggesting no confirmed in-the-wild exploitation yet. The breadth of affected versions (2012 through 2025) is notable: Windows Server 2012 and 2012 R2 are end-of-life platforms for many organizations without Extended Security Updates, making patching operationally harder in those environments. Windows 10 Version 1607 and 1809 appear in the affected version list, which is unusual since the DHCP Server role is not standard on Windows 10 workstation SKUs - this may reflect a shared patching artifact or a component dependency; defenders on workstation SKUs should not assume exposure unless the DHCP Server service is explicitly running.

An attacker who has gained low-privilege network access within a corporate environment - for example, a compromised workstation or valid domain credentials - connects to a Windows DHCP Server and sends a specially crafted DHCP protocol message designed to trigger the heap overflow. Successful exploitation yields code execution within the DHCP Server service context, which could be leveraged to install backdoors, harvest credentials from memory, or pivot to other systems on the same network. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests the overflow is reliably triggerable once the protocol behavior is understood.