CVE-2026-72979

CVE-2026-7296 is a use-after-free memory-corruption flaw (CWE-416) in the Windows DHCP Server role, rated critical (CVSS 9.8). An unauthenticated attacker can trigger it by sending network traffic to the DHCP service, with no credentials or user interaction required. Successful exploitation allows arbitrary code execution on the DHCP server, with high impact on confidentiality, integrity, and availability per the CVSS vector. Any Windows Server with the DHCP Server role enabled is affected; the available data does not enumerate specific affected or fixed build numbers. As of the September 2026 Patch Tuesday release (which patched a record 974 flaws, including two separately exploited Windows zero-days), there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates roughly a 1% probability of exploitation within 30 days.

What to do: Apply the September 2026 Microsoft security updates to every Windows Server with the DHCP Server role, prioritizing servers reachable from untrusted networks such as guest Wi-Fi, branch, and edge sites. Until patched, restrict DHCP traffic (UDP ports 67 and 68) to trusted network segments and monitor for anomalous DHCP activity. Inventory the role on your estate (e.g., via Windows Server role/DHCP server audits) to confirm patch coverage.