CVE-2026-72979 – Windows DHCP Server Remote Code Execution Vulnerability

CVE-2026-72979 is a critical use-after-free vulnerability in Windows DHCP Server. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires low attack complexity, no privileges, and no user interaction, with potential high impact to confidentiality, integrity, and availability.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability exposes affected Windows DHCP Server environments to unauthenticated network-based remote code execution. Successful exploitation could give an attacker the ability to execute code on the target system and cause significant confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not currently reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.

TECHNICAL SUMMARY: CVE-2026-72979 is caused by a use-after-free memory-management weakness (CWE-416) in Windows DHCP Server. An unauthenticated attacker can target an affected service over the network with a specially crafted packet. The attack has low complexity and requires neither privileges nor user interaction. Successful exploitation can result in remote code execution on the target system, with high potential impact to confidentiality, integrity, and availability. An official fix is available.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025; and the listed Server Core installations. Exploitation can occur remotely by sending a specially crafted network packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthenticated attacker to execute code on a vulnerable system. For organizations operating affected DHCP Server environments, this creates a critical risk to system confidentiality, integrity, and availability and could lead to compromise of important infrastructure.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the listed updates require a restart.

URGENCY: This patch should be prioritized because the vulnerability is rated Critical with a CVSS base score of 9.8 and permits network-based remote code execution with low attack complexity. No privileges or user interaction are required, substantially reducing the barriers an attacker must overcome.