CVE-2026-69929

CVE-2026-69929 is an out-of-bounds read (CWE-125) in the Windows DHCP Server service, rated high severity (CVSS 3.1: 7.5) with confidentiality-only impact. An unauthenticated attacker who can send network traffic to an affected machine can trigger the flaw by making the DHCP service process a crafted request that reads beyond the intended buffer. The attacker gains disclosure of server memory contents; per the CVSS vector there is no code execution, tampering, or denial of service. Anyone running the DHCP Server role on Windows Server 2012, 2016, 2019, 2022, or 2025, or on the listed Windows 10 1607/1809 builds, is affected, with real-world risk concentrated on DHCP servers reachable by untrusted or guest network clients. No public proof of concept, CISA KEV listing, or known in-the-wild exploitation exists, and EPSS estimates only a ~0.8% probability of exploitation within 30 days.

What to do: Inventory servers with the DHCP Server role enabled (e.g., via Get-WindowsFeature DHCP on Windows Server or by checking for the DhcpServer service) and prioritize them for Microsoft's security update for CVE-2026-69929 through your normal patch channels. As an interim mitigation, restrict reachability of DHCP servers on UDP port 67 from untrusted or guest network segments where feasible. Monitor Microsoft's advisory for exploitation updates, since no public PoC or in-the-wild exploitation is currently documented.