Windows DHCP Server CVE-2026-69620

The Windows DHCP Server role must be installed and actively running on the target host - this role is not enabled by default on any listed Windows version and must be explicitly provisioned by an administrator. UDP port 67 must be reachable from the attacker's network position; DHCP relay agents can extend the attack surface beyond the local subnet. The CVSS AC:H metric indicates that straightforward exploitation requires non-trivial skill: the attacker must craft a packet that precisely overflows the stack buffer to achieve reliable control flow hijack, implying knowledge of target build-specific memory layout or a memory disclosure primitive. No authentication or user interaction is required once network access to the DHCP listener is established. Windows 10 endpoints without the DHCP Server component enabled are not exploitable via this path.

The CVSS 8.1 score is substantiated by the network-reachable, zero-authentication attack surface of DHCP, but AC:H materially limits real-world exploitability - reliable exploitation almost certainly demands heap/stack layout fingerprinting or a triggered race condition, making opportunistic mass exploitation unlikely at launch. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be independently assessed. That said, the DHCP Server role is pervasive in enterprise and government Active Directory environments, meaning even a mid-sized municipal IT team in zabrze should treat this as urgent given the service's privileged position and the completeness of the C:H/I:H/A:H impact triad. Compensating controls (firewall isolation, DHCP relay inspection) can reduce exposure for organizations that cannot patch immediately.

An attacker with network access to a Windows Server running the DHCP Server role sends a specially crafted DHCP DISCOVER or REQUEST packet designed to overflow a fixed stack buffer in the server's packet parsing routine. After satisfying the exploitation complexity (likely requiring knowledge of the target build's stack layout or a reliable heap-spray primitive), the attacker redirects execution to shellcode or a ROP chain, gaining SYSTEM-level code execution on the DHCP server. Because the DHCP Server typically runs as SYSTEM and manages critical network infrastructure, full domain network control is achievable from this initial foothold. No public proof-of-concept code is known at time of analysis.