Microsoft Windows DHCP Server Flaw Rated Critical for Remote Code Execution

Microsoft has disclosed a critical security vulnerability in the Windows DHCP Server that allows unauthorized attackers to execute code over a network. The flaw, identified as CVE-2026-96934, is rated critical by the National Vulnerability Database due to its high potential for remote exploitation.

The National Vulnerability Database assigns a CVSS score of 9.8 to this issue, marking it as critical. Microsoft’s security update guide classifies the weakness as a use-after-free error within the Windows DHCP Server. This specific type of memory corruption flaw can allow an attacker to run arbitrary code on a targeted system without prior authentication.

Context and Background

This disclosure follows a pattern of recent critical findings in Windows networking components. As Threat Times reported on 2026-10-14, Microsoft disclosed a critical remote code execution flaw in the Windows Imaging Component involving a heap-based buffer overflow.

On the same date, Threat Times covered another critical vulnerability in Windows iSCSI. That issue was a use-after-free error that allowed remote code execution and also received a 9.8 CVSS score from Microsoft and the NVD. The current DHCP Server flaw shares the same high severity rating and similar remote execution capabilities.

Who Is Affected

Systems running the Windows DHCP Server component are potentially affected by CVE-2026-96934. The vulnerability allows an unauthorized attacker to execute code over a network, meaning no local access or valid credentials are required for initial exploitation.

The National Vulnerability Database lists the underlying weakness as CWE-416, which corresponds to a use-after-free error. This indicates that the software accesses memory after it has been freed, leading to unpredictable behavior that attackers can manipulate for code execution.

What should you do?

No patch or fix has been confirmed yet in the available source material. Security professionals should monitor official Microsoft security advisories for updates regarding CVE-2026-96934. Until a vendor-provided update is available, organizations should restrict network access to DHCP servers where possible.

What to do and how to stay safe: Microsoft

• Verify if your network infrastructure includes Windows DHCP Server instances that may be exposed to untrusted networks.
• Monitor Microsoft Security Update Guide and NVD records for the release of a patch for CVE-2026-96934.
• Implement network segmentation to limit access to DHCP servers, reducing the attack surface for remote exploitation.
• Review firewall rules to ensure that only authorized systems can communicate with DHCP services on your network.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96934?

The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.8.

What type of vulnerability is CVE-2026-96934?

It is a use-after-free error in the Windows DHCP Server that allows remote code execution.

Is authentication required to exploit this flaw?

No, Microsoft states that an unauthorized attacker can execute code over a network, implying no authentication is needed.