CVE-2026-69547

CVE-2026-69547 is a heap-based buffer overflow (CWE-122) in the DHCP Server component of Microsoft Windows. By sending crafted DHCP traffic over the network, an authorized, low-privilege attacker can corrupt heap memory in the DHCP Server service, potentially executing arbitrary code with the privileges of that service. Successful exploitation carries high impact on confidentiality, integrity, and availability of the affected server (CVSS 3.1: 8.8). Organizations running the Microsoft DHCP Server role on Windows Server are in scope; the available data does not enumerate specific affected version ranges. There is no known public proof of concept, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at roughly 0.9% (58th percentile), indicating no known exploitation at this time.

What to do: Monitor Microsoft's advisory and apply the security update for affected Windows Server versions as soon as it is released. Until patched, restrict reachability of the DHCP service (UDP 67/68) to trusted network segments and monitor DHCP service health and logs for anomalous client traffic. Confirm whether the DHCP Server role is installed on your Windows Servers (e.g., via the Server Manager/DISM role inventory) to prioritize patching.