CVE-2026-70250 – Windows DHCP Client Remote Code Execution Vulnerability

Microsoft has addressed a Critical Remote Code Execution (RCE) vulnerability in the Windows DHCP Client that could allow an unauthorized attacker on an adjacent network to execute malicious code on an affected system. The vulnerability, tracked as CVE-2026-70250, involves a use-after-free condition and improper synchronization of shared resources. With a CVSS score of 8.8, the vulnerability is particularly concerning because exploitation requires no authentication, no special privileges, and no user interaction. Although Microsoft considers exploitation less likely, the potential impact on confidentiality, integrity, and availability makes this an important security update for organizations running affected Windows systems.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a significant security risk because an attacker with access to an adjacent network could potentially execute unauthorized code on a vulnerable Windows system.

The attack complexity is rated Low, meaning exploitation does not require complex conditions once the attacker is in a suitable network position.

The most concerning aspect is that the vulnerability requires neither user privileges nor user interaction. An attacker would not need valid credentials or assistance from an employee to attempt exploitation.

Successful exploitation could result in:

• Unauthorized code execution: Attackers could execute malicious instructions on affected Windows systems.
• Sensitive information exposure: Confidential business information could potentially be accessed or stolen.
• System compromise: Attackers could interfere with system operations or modify information.
• Service disruption: Successful attacks could affect system availability and interrupt business operations.
• Network security exposure: Systems accessible from adjacent networks could become potential attack targets.

The vulnerability has a High impact rating across confidentiality, integrity, and availability, making successful exploitation particularly damaging.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication:

• Actively Exploited: No.
• Publicly Disclosed: No.
• Zero-Day Exploitation: No known exploitation is reported.
• Public Proof-of-Concept (PoC): The existence of publicly available PoC exploit code is not confirmed.
• Exploit Code Maturity: Unproven.

Although there is no reported active exploitation, the vulnerability’s low attack complexity and lack of authentication requirements make it an important security concern.

The absence of confirmed exploitation does not eliminate the possibility of future attacks, particularly if technical exploitation methods become publicly available.

Technical Summary

CVE-2026-70250 is a Remote Code Execution vulnerability in the Windows DHCP Client, caused by a combination of memory management and concurrency weaknesses.

The vulnerability involves two security weaknesses:

1. CWE-416 – Use After Free

A use-after-free vulnerability occurs when software attempts to access memory after that memory has already been released.

This can create unsafe memory conditions that attackers may potentially manipulate to execute unauthorized code.

In this case, the weakness exists within the Windows DHCP Client and could allow remote code execution from an adjacent network.

2. CWE-362 – Race Condition

A race condition occurs when multiple operations access shared resources without proper synchronization.

When these operations execute in an unexpected order, they can create inconsistent system states or unsafe memory conditions.

The vulnerability combines improper synchronization with a use-after-free condition, creating an opportunity for an attacker to trigger unintended behavior.

Attack Characteristics:

The vulnerability has the following characteristics:

• Attack Vector: Adjacent Network (AV:A).
• Attack Complexity: Low (AC:L).
• Privileges Required: None (PR:N).
• User Interaction: None (UI:N).
• Scope: Unchanged.
• Confidentiality Impact: High.
• Integrity Impact: High.
• Availability Impact: High.

An attacker must have access to an adjacent network to attempt exploitation.

Unlike vulnerabilities that require users to open malicious files or click suspicious links, this issue does not depend on user interaction.

Successful exploitation could allow an unauthorized attacker to execute code on an affected system.

The exact exploitation sequence and resulting execution privileges are not specified.

Microsoft has released an official security fix to address the vulnerability.

Exploitability

The vulnerability affects several Windows client and server operating systems.

Affected Microsoft Products:

• Windows 10 Version 1607 (x64).
• Windows 10 Version 1809 (32-bit and x64).
• Windows Server 2012 and 2012 R2.
• Windows Server 2016.
• Windows Server 2019.
• Windows Server 2022.
• Windows Server 2025.

Server Core installations of the affected Windows Server versions are also vulnerable.

An attacker positioned on an adjacent network could potentially exploit the Windows DHCP Client memory management weakness to execute unauthorized code.

Exploitation requires no privileges and no user interaction, with attack complexity rated Low.

However, Microsoft currently assesses successful exploitation as less likely.

Business Impact

CVE-2026-70250 represents a significant security concern for organizations operating vulnerable Windows endpoints and servers.

Because DHCP is a fundamental component of network connectivity, weaknesses in the Windows DHCP Client deserve particular attention.

Successful exploitation could create several business risks.

1. Unauthorized System Compromise

Attackers could execute malicious code on affected Windows systems, potentially compromising important business endpoints or servers.

Depending on the privileges obtained, this could provide opportunities for further malicious activity.

2. Exposure of Sensitive Business Information

The vulnerability carries a High confidentiality impact.

Successful exploitation could potentially expose sensitive business information, including internal documents and other confidential information accessible to the compromised system.

3. Operational Disruption

With a High availability impact, successful exploitation could interfere with the normal operation of affected systems.

For organizations relying on Windows Server infrastructure, disruption of critical systems could affect business operations and service delivery.

4. Data Integrity Risks

The vulnerability also carries a High integrity impact.

A successful attacker could potentially modify or corrupt information, creating risks for business applications and operational processes.

5. Increased Internal Network Exposure

Because exploitation is possible from an adjacent network, organizations should pay particular attention to environments where untrusted devices share network access with vulnerable Windows systems.

“An attacker does not always need a stolen password to compromise a system. Sometimes, access to the same network is enough to create a serious security threat.”

For organizations managing large Windows environments, addressing this vulnerability helps reduce the risk of unauthorized code execution and potential business disruption.

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

If immediate patching is not possible, organizations should consider temporary risk-reduction measures:

• Restrict network access: Limit connectivity between untrusted networks and vulnerable systems where operationally possible.
• Strengthen network segmentation: Separate sensitive servers and business-critical systems from less trusted network segments.
• Monitor suspicious activity: Watch for unusual network behavior and unexpected activity involving affected Windows systems.
• Prioritize exposed systems: Identify vulnerable devices that operate on shared or less trusted networks.

These measures may reduce exposure but do not eliminate the underlying vulnerability.

Installing the official Microsoft security update remains the recommended remediation.

Urgency

Priority: High – Critical Security Update

Although Microsoft has assessed exploitation as less likely and has not reported active exploitation, CVE-2026-70250 should receive priority in the organization’s patch deployment schedule.

Several factors make this vulnerability particularly important:

• Critical severity: The vulnerability has a CVSS base score of 8.8.
• No authentication required: Attackers do not need valid credentials.
• No user interaction required: Exploitation does not depend on employees opening files or clicking links.
• Low attack complexity: The vulnerability does not require complex attack conditions.
• High potential impact: Successful exploitation could compromise confidentiality, integrity, and availability.
• Broad Windows exposure: Multiple Windows client and server versions are affected.

Microsoft Security Updates:

The following security updates address the affected operating systems:

• KB5126868: Windows 10 Version 1607 and Windows Server 2016.
• KB5126651: Windows 10 Version 1809 and Windows Server 2019.
• KB5126835: Windows Server 2012.
• KB5126836: Windows Server 2012 R2.
• KB5126655: Windows Server 2022.
• KB5126646: Windows Server 2025.

A system restart is required after installing the applicable security update.

No known issues are listed for these updates.

Organizations should prioritize patching vulnerable systems based on network exposure, system criticality, and business impact.

While active exploitation has not been reported, delaying remediation leaves affected systems exposed to a potentially serious remote code execution vulnerability.

“Critical vulnerabilities do not need active attacks to become business risks. Patching early helps prevent a security weakness from becoming a costly incident.”