CVE-2026-70065

CVE-2026-70065 is a memory-safety flaw (CWE-401, missing release of memory after effective lifetime, commonly described as a use-after-free) in the Windows DHCP Server service. An unauthenticated attacker with network reachability to the DHCP Server service can send traffic that triggers the memory-handling error and disrupts the service. The impact is denial of service only — the CVSS vector shows no confidentiality or integrity impact but a high availability impact — so the DHCP service can crash or hang and stop serving leases. Any organization running the DHCP Server role on Windows Server is potentially affected; no specific affected version ranges are provided in the available data. No exploitation has been reported: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns a 1.2% probability of exploitation within 30 days (66th percentile).

What to do: Apply Microsoft's security update for CVE-2026-70065 when released, prioritizing servers where the DHCP Server role is enabled. Until patched, restrict reachability of the DHCP service (UDP 67/68) to trusted network segments and monitor for DHCP service crashes or restarts. Inventory which Windows Servers run the DHCP Server role to scope patching, since version details are not provided in the available data.