CVE-2026-69930

CVE-2026-69930 is an out-of-bounds read (CWE-125) in the Windows DHCP Server service that Microsoft rates High (CVSS 3.1: 7.5) because it is reachable over the network without authentication or user interaction. An attacker who can send crafted DHCP packets to a vulnerable Windows machine running the DHCP Server role can trigger the service to read beyond allocated memory and disclose the contents of that memory. The attacker gains access to potentially sensitive information from server memory (confidentiality impact is rated High), with no integrity or availability impact indicated in the scoring. Affected systems are Windows clients and Windows Servers with the DHCP Server role enabled — spanning Windows 10 1607/1809 and Windows Server 2012 through 2025 — which in practice typically means internal enterprise DHCP servers rather than internet-facing hosts. There is no known exploitation, no public proof-of-concept, and the flaw is not in CISA's KEV catalog; EPSS currently assigns about a 0.8% probability of exploitation within 30 days.

What to do: Inventory Windows hosts with the DHCP Server role enabled (e.g., via Get-WindowsFeature DHCP or checking the DHCP Server service state) and apply Microsoft's security update for CVE-2026-69930 as provided for each affected version, noting that 1607/1809 and older server builds may receive fixes only through extended-support/ESU channels depending on the build. Until patched, restrict which network segments and clients can reach the DHCP service (UDP 67/68), especially from untrusted or guest networks. With no public PoC or in-the-wild exploitation reported, prioritize patching by network exposure rather than observed attack activity.