CVE-2026-69845 – Windows DHCP Server Remote Code Execution Vulnerability

CVE-2026-69845 is a Critical remote code execution vulnerability in Windows DHCP Server caused by improper input validation leading to a heap-based buffer overflow. An unauthorized in-network attacker could exploit the flaw by calling arbitrary endpoints and potentially execute code remotely. The vulnerability has a CVSS base score of 9.8. It is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability can be attacked over a network with low attack complexity. Successful exploitation could result in remote code execution and carries High impact to confidentiality, integrity, and availability. No privileges or user interaction are required.

EXPLOITS: The exploitability assessment is Exploitation Less Likely. Exploit code maturity is classified as Unproven. The vulnerability is not publicly disclosed and is not known to be exploited. The existence of public exploit code, a zero-day exploit, or proof-of-concept exploit code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-69845 involves improper input validation and a heap-based buffer overflow in Windows DHCP Server, identified as CWE-20 and CWE-122. An unauthorized in-network attacker can call arbitrary endpoints to trigger the vulnerability. Successful exploitation can allow remote code execution over the network. Attack complexity is Low, privileges are not required, and no user interaction is necessary. The CVSS metrics rate confidentiality, integrity, and availability impacts as High.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607 and 1809, Windows Server 2012 and 2012 R2, and Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation can occur through an in-network attacker calling arbitrary endpoints.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on affected systems, creating the potential for serious compromise of confidentiality, integrity, and availability. For organizations operating affected DHCP servers, compromise of this infrastructure could create significant security and operational risk.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified as the remediation.

URGENCY: This patch should receive urgent deployment priority because the vulnerability is rated Critical with a CVSS base score of 9.8 and enables network-based remote code execution with low attack complexity. No privileges and no user interaction are required, increasing the potential exposure of affected systems.