Windows DHCP Server EUVD-2026-99940

Exploitation requires the target host to have the Windows Server DHCP Server role installed and running, with the attacker able to reach the DHCP service over the network (UDP/67-68 or RPC management interface). The flaw is reachable pre-authentication (PR:N) against affected builds of Windows Server 2012 through 2025 and Windows 10 1607/1809 listed in EUVD. Limiting factors: servers not running the DHCP Server role are unaffected, and DHCP infrastructure is typically confined to internal/management network segments rather than exposed to the internet, which substantially narrows the realistic attacker population to those already on the local or routable internal network.

Signals are consistent and point to a genuine but bounded availability risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, unauthenticated, low-complexity trigger with no user interaction, and the impact is availability-only (A:H, C:N/I:N) - a pure denial-of-service via null pointer dereference (CWE-476), with no path to code execution or data compromise. CISA's SSVC framework aligns with this: Exploitation=none (no observed or public exploitation), Automatable=yes (the trigger can be scripted/sprayed once known), and Technical Impact=partial (service crash, not full system takeover). The CVE is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis; EPSS was not provided. The 'Automatable: yes' flag is the main escalator - if a working trigger emerges, it could be fired broadly against exposed DHCP services - but the absence of confidentiality/integrity impact and the fact that core infrastructure DHCP is typically not internet-exposed keep real-world priority at moderate. Net: a legitimate patch-soon item for organizations running the Windows DHCP Server role, not a drop-everything critical. Note that A:H on a service-only crash yields a 7.5 base score that overstates enterprise urgency relative to its availability-only, no-persistence nature.

An attacker with network reachability to a Windows Server running the DHCP Server role sends a crafted DHCP message that triggers a null pointer dereference in the server's packet handling, crashing the service. No authentication or user interaction is required. Because DHCP underpins automatic IP addressing, the crash can disrupt address leasing for an entire network segment until the service recovers or is restarted. No public exploit code is identified at time of analysis.