CVE-2026-69510

A stack-based buffer overflow (CWE-121) in the Microsoft Windows DHCP Server component can be triggered over the network by an unauthenticated attacker, potentially leading to remote code execution on the affected host; the CVSS 'high attack complexity' score (AC:H) indicates exploitation likely depends on specific conditions rather than straightforward attacks. An attacker who successfully exploits it gains code execution with high impact on the confidentiality, integrity and availability of the DHCP server (CVSS 3.1: 8.1, High), potentially disrupting or taking control of a core IP address-assignment service. Only systems actually running the DHCP Server role/service are practically exposed to this flaw; the affected products per Microsoft's CPE data are Windows 10 versions 1607 and 1809 (LTSC/LTSB servicing branches) and Windows Server 2012, 2016, 2019, 2022 and 2025. There is currently no known exploitation, no public proof-of-concept, and the vulnerability is not in CISA's KEV catalog; EPSS estimates roughly a 0.7% (~1-in-140) probability of exploitation within 30 days (51st percentile). Defenders should still treat this as a priority network-reachable RCE given the unauthenticated attack surface presented by DHCP servers.

What to do: Install Microsoft's security update for each affected Windows version as soon as it is available, prioritizing hosts with the DHCP Server role enabled that are reachable from untrusted or user networks. As an interim measure, inventory DHCP servers and restrict which network segments can reach them (UDP 67 and DHCP relay traffic, limiting exposure to trusted relay agents and management networks). Note that Windows 10 1607/1809 (LTSC branches) and Windows Server 2012 are on extended servicing, so verify your support arrangement (LTSC/ESU) delivers the fix.