Windows DHCP Server CVE-2026-69876

Exploitation requires two concrete prerequisites: (1) the attacker must be positioned on the same network segment as the target Windows DHCP Server - either physically adjacent (same LAN/VLAN) or via a routed path that reaches the DHCP service on UDP/67 - ruling out direct internet exploitation; (2) the attacker must hold at least low-level authorized access to the network (PR:L per CVSS vector), meaning anonymous internet actors cannot exploit this without first gaining some foothold. The DHCP Server role must be installed and active on the target Windows Server host; systems not running the DHCP Server role are not affected. Windows 10 systems are listed as affected only in specific builds (1607, 1809), presumably when the DHCP Server feature is enabled, which is non-default for workstations. No user interaction is required once the attacker is positioned.

The CVSS 8.0 score reflects a meaningful but bounded threat profile: AV:A limits exploitation to attackers already on the same Layer-2 or Layer-3 segment as the DHCP server, and PR:L indicates some level of authorized access is required rather than fully anonymous exploitation from the internet. EPSS data was not provided, and the absence of both a CISA KEV listing and known public exploit code further moderates urgency compared to a weaponized, internet-facing RCE. That said, the C:H/I:H/A:H impact means successful exploitation fully compromises the DHCP server host - a high-value server-infrastructure target whose compromise could enable ARP/DHCP poisoning, lateral movement, or denial of address-assignment to the entire subnet. Even a mid-sized municipal IT team in rybnik running on-premises Windows Server infrastructure should treat this as urgent given the wide affected-version range (Server 2012 through 2025) and the fact that DHCP servers often sit on trusted internal segments with many clients. The "Denial Of Service" tag on this record understates the declared impact - the description explicitly states code execution, not mere service disruption. SSVC assessment: exploitation status not yet active, attack is not fully automatable from the internet (adjacent + PR:L gate), but technical impact is total once inside the adjacent network.

An attacker with low-privilege access on the same internal network segment as the Windows DHCP Server crafts a malformed DHCP request packet designed to trigger the use-after-free condition in the server's packet-processing code. By controlling heap layout to place attacker-supplied data at the freed memory address, the attacker redirects execution flow and achieves arbitrary code execution under the DHCP Server service account. No public exploit code has been identified at time of analysis, but the AC:L rating indicates that once positioned on the adjacent network, exploitation does not require unusual preconditions.