Windows DHCP Server CVE-2026-69830

Requires a reachable, running Windows DHCP Server role accepting DHCP traffic from the attacker's network segment; exploitation is unauthenticated (PR:N) and needs no user interaction. The primary limiting factor is the race-condition timing dependency (AC:H) - the attacker must win a narrow, non-deterministic synchronization window on a shared resource, so exploitation is unreliable and typically demands repeated concurrent requests and possibly specific server load conditions. Hosts without the DHCP Server role installed, or where DHCP is not network-reachable by the attacker, are not exposed.

This is a genuinely serious but practically difficult vulnerability. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) scores 8.1 and combines the worst-case attributes of network reach, no authentication, and no user interaction with full CIA impact - a potential unauthenticated remote code execution on a core infrastructure service. The critical counterweight is AC:H: as a CWE-362 race condition, successful exploitation depends on winning a timing-sensitive window that is not reliably controllable by the attacker, which substantially reduces real-world exploitability and typically requires many attempts or specific load conditions. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this tempers urgency relative to the headline score. Note a tagging conflict: the input carries an 'Authentication Bypass' tag, but the description and CWE-362 describe a race-condition RCE, not an authentication-bypass class - the PR:N (unauthenticated) metric likely drove that mislabel. Net: treat as a high-priority patch item for exposed Windows DHCP servers, but the AC:H timing dependency means widespread reliable exploitation is less likely than the 8.1 suggests absent a published weaponized technique.

An attacker with network access to a Windows DHCP Server rapidly sends concurrent, carefully timed DHCP messages to trigger a race condition in the server's handling of a shared resource, corrupting memory in a way that yields code execution in the DHCP service context. No credentials or user interaction are required, but the attacker must repeatedly attempt the race to hit the narrow timing window (AC:H). No public exploit code was identified in the provided intelligence.