CVE-2026-69342

CVE-2026-69342 is an out-of-bounds read (CWE-125) in the Windows DHCP Server service. A remote, unauthenticated attacker can trigger the flaw by sending maliciously crafted network traffic to the DHCP service, with no credentials or user interaction required. Successful exploitation causes a high-impact availability failure — the DHCP Server service stops responding or crashes — while confidentiality and integrity are unaffected, per the CVSS vector (C:N/I:N/A:H). Any organization running the DHCP Server role on the listed Windows 10 or Windows Server releases is exposed, which in practice means the primary address-assignment service for entire enterprise networks. Exploitation has not been observed: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS places the 30-day exploitation probability at about 1.1% (65th percentile).

What to do: Apply Microsoft's security update for CVE-2026-69342 on all systems running the DHCP Server role, prioritizing core-network or internet-reachable DHCP servers. As an interim mitigation, restrict which network segments and hosts can reach the DHCP service (UDP port 67) and monitor for unexplained service crashes or restarts. Start with an inventory for the DHCP Server role, since desktop Windows 10 devices without the role are not meaningfully exposed.