CVE-2026-96934 – Windows DHCP Server Remote Code Execution Vulnerability

Microsoft has addressed a Critical Remote Code Execution (RCE) vulnerability in the Windows DHCP Server service that could allow an unauthenticated attacker to execute malicious code remotely or disrupt DHCP operations. The vulnerability affects Windows DHCP servers configured in failover mode and occurs when specially crafted network packets trigger a memory corruption condition. Successful exploitation could compromise the affected server or cause the DHCP service to stop responding. With a CVSS score of 9.8, low attack complexity, and no authentication requirements, this vulnerability represents a significant security risk for organizations relying on Windows DHCP infrastructure.

CVSS SCORE: 9.8

SEVERITY: Critical

Threat

This vulnerability presents a serious threat to organizations operating Windows DHCP servers in failover configurations.

An attacker with network access to a vulnerable DHCP service could send specially crafted packets to trigger remote code execution or cause the service to become unresponsive.

The primary security concerns include:

• Remote Code Execution: Attackers could execute arbitrary malicious code on the affected DHCP server.
• Service Disruption: Exploitation could make the DHCP service unresponsive, potentially affecting network connectivity.
• Unauthorized Server Access: Successful exploitation could compromise the confidentiality and integrity of the affected server.
• Network Availability: Disruption of DHCP operations could prevent devices from obtaining or renewing IP addresses, affecting business-critical connectivity.

The vulnerability has a network-based attack vector, low attack complexity, and requires neither authentication nor user interaction, making it particularly concerning for exposed DHCP failover environments.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication, the vulnerability was not publicly disclosed and had not been exploited.

The exploit code maturity is classified as Unproven, meaning publicly available working exploit code or proof-of-concept (PoC) exploitation is not confirmed.

There is no confirmed evidence of active exploitation or zero-day attacks associated with this vulnerability.

However, the vulnerability’s low attack complexity and lack of authentication requirements create a potentially attractive attack opportunity.

Technical Summary

CVE-2026-96934 is a Use-After-Free (CWE-416) memory corruption vulnerability affecting the Windows DHCP Server service.

The vulnerability exists in how Windows DHCP failover servers process specially crafted network packets.

A Use-After-Free vulnerability occurs when software attempts to access memory that has already been released. This can lead to memory corruption, application crashes, or unintended code execution.

In this case, an attacker could exploit the vulnerability by sending a specially crafted packet to an affected Windows DHCP server.

If the server is configured in DHCP failover mode, the malicious packet could trigger the memory corruption condition.

Successful exploitation could result in two significant outcomes:

• Remote Code Execution: The attacker could execute arbitrary code on the vulnerable DHCP server, potentially compromising the system.
• Denial of Service: The DHCP service could become unresponsive, potentially interrupting IP address assignment and renewal operations.

The vulnerability is particularly concerning because the attack can be performed remotely over the network without valid credentials.

The CVSS assessment confirms that exploitation requires no privileges, no user interaction, and low attack complexity.

However, a key exploitation requirement is that the targeted DHCP server must be configured in failover mode.

Microsoft’s security update addresses the underlying issue by correcting how DHCP failover servers handle network packets.

Exploitability

The vulnerability affects the following Microsoft products:

• Windows Server 2025 – KB5126646
• Windows Server 2022 – KB5126655
• Windows Server 2019 – KB5126651
• Windows Server 2016 – KB5126868
• Windows Server 2012 R2 – KB5126836
• Windows Server 2012 – KB5126835
• Windows 10 Version 1809 – KB5126651
• Windows 10 Version 1607 – KB5126868

Both standard and Server Core installations are affected where listed for Windows Server. The affected Windows 10 versions include 32-bit and x64-based systems.

Exploitation requirements:

• Network access to the vulnerable DHCP service.
• DHCP server configured in failover mode.
• No authentication or privileges required.
• No user interaction required.

An attacker could exploit the vulnerability by transmitting a specially crafted network packet to the affected service.

Business Impact

This vulnerability could have significant operational and security consequences for organizations that rely on Windows DHCP servers for network connectivity.

DHCP services play an important role in automatically assigning IP addresses and maintaining connectivity across enterprise networks.

A successful attack could compromise the affected server or interrupt DHCP operations.

Potential business consequences include:

• Network Connectivity Disruptions: DHCP service failures could prevent new devices from obtaining IP addresses or existing devices from renewing their network configurations.
• Business Service Interruptions: Employees and business applications may experience connectivity problems if DHCP operations become unavailable.
• Server Compromise: Remote code execution could allow attackers to run unauthorized programs or malicious code on affected systems.
• Operational Downtime: IT teams may need to investigate compromised systems, restore affected services, and recover normal network operations.
• Security Exposure: Successful exploitation could affect the confidentiality, integrity, and availability of the compromised server.

Organizations using DHCP failover for high availability should pay particular attention because the failover configuration itself is a necessary condition for exploiting this vulnerability.

“A vulnerability in a service designed to keep networks connected could become the very reason those networks go offline.”

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

If immediate patching is not possible, organizations should consider the following temporary risk-reduction measures:

• Restrict network access to DHCP servers to trusted systems and networks wherever operationally feasible.
• Review DHCP failover configurations and identify potentially exposed servers.
• Monitor DHCP servers for unusual network traffic, unexpected service failures, or suspicious activity.
• Consider disabling DHCP failover only where operational requirements permit, after assessing the potential availability impact.

These measures may help reduce exposure but do not eliminate the underlying vulnerability.

Installing the official Microsoft security update remains the recommended remediation.

A system restart is required after installing the applicable security update.

Urgency

Critical Priority – Accelerated Patch Deployment Recommended

CVE-2026-96934 carries a Critical severity rating and a CVSS score of 9.8, placing it among the highest-impact vulnerability categories.

Although Microsoft assesses exploitation as less likely and has not reported active exploitation, several technical characteristics justify accelerated patch deployment.

The vulnerability can be triggered remotely over the network, requires low attack complexity, and does not require authentication or user interaction.

Successful exploitation could allow arbitrary code execution or cause DHCP service outages.

Organizations should prioritize identifying and patching Windows DHCP servers operating in failover mode, particularly those accessible from less-trusted network segments.

Recommended deployment approach:

• Priority 1: Identify Windows DHCP servers configured in failover mode and assess their network exposure.
• Priority 2: Deploy the applicable security updates to affected DHCP failover servers through an expedited change process.
• Priority 3: Schedule the required system restarts while maintaining DHCP service availability.
• Priority 4: Verify successful patch installation and confirm normal DHCP operations after deployment.

Despite the absence of confirmed exploitation, the potential consequences of a successful attack make timely remediation important.

The combination of remote code execution, zero authentication requirements, and potential DHCP service disruption makes this a critical vulnerability that organizations should address promptly.