Windows DHCP Server CVE-2026-69847

Exploitation requires three specific conditions: (1) The target system must have the Windows DHCP Server role or component active and running - this is not installed by default and must be deliberately configured; (2) The attacker must have adjacent network access, meaning physical or logical Layer 2 adjacency to the DHCP server (same broadcast domain, VLAN, or VPN tunnel) - internet-facing remote exploitation is not possible via this vector; (3) The attacker must be 'authorized' per the description, aligned with PR:L in the CVSS vector, meaning some form of low-privilege network authentication or presence on the network is required rather than completely anonymous access. Exploitation is limited by network topology (no AV:N remote path), the requirement for the DHCP Server role to be explicitly installed, and the low-privilege authentication prerequisite. Windows 10/11 client exposure depends on whether any DHCP server-side component is active on those endpoints.

The CVSS 8.0 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a serious but network-topology-limited vulnerability. AV:A is the key limiting factor: exploitation is constrained to attackers already on the same network segment (broadcast domain, VLAN, or VPN subnet) as the DHCP server, which substantially reduces internet-scale exposure compared to AV:N vulnerabilities. PR:L indicates low-privilege authenticated access is required, further narrowing the threat actor pool to insiders or already-compromised network participants. On the other hand, DHCP servers are often deployed on core infrastructure servers, and successful code execution on a DHCP server in an Active Directory environment could allow an attacker to hijack IP assignments (DHCP poisoning) and pivot laterally. No public exploit code and no CISA KEV listing is confirmed at time of analysis, suggesting this has not yet been observed in active exploitation campaigns. The broad affected version range (2012 through 2025) means unpatched organizations face wide exposure. EPSS data not provided in input; risk should be treated as elevated for any Windows Server environment with the DHCP Server role enabled.

An attacker with low-privilege access on the same network segment as a Windows DHCP Server - for example, a domain-joined workstation user or a compromised host on the same VLAN - sends a specially crafted DHCP request or related protocol message that triggers a heap buffer overflow in the DHCP Server service process. The overflow allows the attacker to overwrite heap structures and redirect execution to attacker-controlled code, achieving arbitrary code execution as the DHCP Server service account (typically NT AUTHORITY\SYSTEM). No public proof-of-concept code has been identified at time of analysis.