CVE-2026-77888

CVE-2026-77888 is a type confusion flaw (CWE-843) in the Windows DHCP Server role that lets an unauthenticated remote attacker crash or hang the service. It is triggered by sending crafted network traffic to the DHCP service, which processes data using an incompatible type and fails; no privileges or user interaction are required. An attacker gains only denial of service (confidentiality and integrity are unaffected), but a successful attack could disrupt address assignment for the clients that depend on that DHCP server. Any organization running the DHCP Server role on Windows Server is affected, with exposure greatest where the service is reachable from untrusted or broadly accessible network segments. As of this analysis there is no known public proof-of-concept, no CISA KEV listing, and a low 0.9% EPSS probability of exploitation within 30 days, indicating no confirmed in-the-wild exploitation.

What to do: Apply Microsoft's security update for CVE-2026-77888 on all Windows Server systems that have the DHCP Server role enabled, prioritizing servers reachable from untrusted networks or large client populations. Until patching is complete, restrict which network segments can send traffic to the DHCP service and monitor those servers for service crashes or restarts. Confirm exposure by inventorying servers with the DHCP role (e.g., via Get-WindowsFeature or your configuration management data) rather than assuming default configurations.