CVE-2026-69876

CVE-2026-69876 is a use-after-free memory-corruption flaw in the DHCP Server role of Microsoft Windows (also tagged with CWE-415, double free). An authorized attacker positioned on an adjacent network segment can send crafted DHCP service traffic that causes the server to reuse freed memory, corrupting the process and leading to arbitrary code execution. Successful exploitation gives the attacker code execution on the DHCP server with high impact on confidentiality, integrity, and availability, and DHCP servers are core infrastructure often co-located with domain controllers, so a foothold there is a useful pivot point. Any organization running the DHCP Server role on Windows Server is potentially affected, though the flaw is limited to authorized, adjacent-network attackers rather than unauthenticated remote attackers. There is currently no known exploitation: the CVE is not in CISA KEV, has a low EPSS score (0.6%, 46th percentile), and no public proof-of-concept is known.

What to do: Inventory servers with the DHCP Server role enabled (e.g., via your configuration-management or Windows feature inventory) and apply Microsoft's security update for this CVE as soon as it is released, checking the MSRC advisory and the next Patch Tuesday. Until patched, limit which network segments and devices can reach the DHCP service on these servers and monitor for DHCP service crashes or restarts. Given the adjacent-network, authorized-attacker requirement and the low EPSS score, treat this as a standard-priority patch, prioritizing DHCP servers on core or broadly reachable segments.