Windows DHCP Server EUVD-2026-99863

The target must be running the Windows DHCP Server role (not a default role on every Windows Server, but common in enterprise domains) on an unpatched build within the affected ranges (e.g., Server 2016 <10.0.14393.9612, Server 2019 <10.0.17763.9376, Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650, Server 2012/2012 R2, and Windows 10 1607/1809). Exploitation is network-based (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but requires pre-existing low-level privileges (PR:L) - the attacker must already be authenticated or hold a network foothold, which is the primary limiting factor. CISA SSVC marks the flaw as not automatable, indicating exploitation is not trivially scalable and likely requires deliberate targeting.

This is a genuinely serious flaw but not an immediate emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation by an attacker who already holds some privileges (PR:L), yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - consistent with remote code execution in the DHCP Server service and the 8.8 score. However, the risk signals point to lower real-world urgency than the base score alone implies: CISA's SSVC decision framework reports Exploitation=none and Automatable=no, while Technical Impact=total agrees with the RCE claim. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The PR:L requirement is the key mitigating factor - this is not an unauthenticated internet worm scenario; an attacker must first possess valid network credentials or a foothold. Net: a high-priority patch for organizations running the Windows DHCP Server role (RCE on a core network service), but current exploitation probability appears low and targeted rather than mass/automatable per SSVC.

An attacker who has already obtained low-privilege authenticated network access (e.g., a standard domain account or a foothold on an internal host) sends specially crafted DHCP traffic to a vulnerable Windows DHCP Server, overflowing a stack buffer in the service to execute arbitrary code in its context. Because the DHCP service typically runs with high privileges on a core infrastructure server, successful exploitation can lead to full server compromise. No public exploit code is identified at time of analysis, and SSVC rates the flaw as not automatable, implying any attack would be deliberate and hands-on.