Microsoft Windows DHCP Server Has Critical Remote Code Execution Flaw
A heap-based buffer overflow in the Windows DHCP Server allows unauthorized attackers to execute code remotely, rated critical by the NVD.
Key points
- CVE-2026-96320 affects the Windows DHCP Server component.
- The flaw is a heap-based buffer overflow enabling remote code execution.
- The National Vulnerability Database rates the severity as 9.8 Critical.
Microsoft’s Windows DHCP Server contains a critical remote code execution vulnerability identified as CVE-2026-96320. According to the Microsoft Security Update Guide, this flaw allows an unauthorized attacker to execute arbitrary code on a target system over a network connection.
The National Vulnerability Database assigns a CVSS score of 9.8 to this issue, classifying it as critical. The underlying weakness is a heap-based buffer overflow, categorized under CWE-122. This type of memory corruption error occurs when data is written beyond the boundaries of a designated memory block, potentially allowing an attacker to overwrite critical system structures and gain control of the affected process.
Technical Details and Severity
The vulnerability resides specifically within the Windows DHCP Server service. Because the flaw can be exploited remotely, an attacker can initiate the attack from a remote network location. The Microsoft advisory notes that the attacker remains unauthorized, meaning they do not need valid credentials to trigger the exploit.
The NVD record confirms the severity rating but does not provide additional details on specific attack vectors beyond the remote execution capability. The high CVSS score reflects the critical nature of the vulnerability as rated by the database.
Affected Systems
The Windows DHCP Server is a core component of Windows Server operating systems, used to assign IP addresses and other network configuration parameters to devices on a network. Any organization running Windows Server with the DHCP role enabled is potentially affected by CVE-2026-96320.
Microsoft’s advisory does not specify which exact versions of Windows Server are vulnerable, nor does it list any versions that are immune. Security professionals should assume that any system running the DHCP Server service on Windows Server is at risk until further clarification is provided. The lack of version specificity in the initial advisory requires administrators to verify their environments carefully.
What should you do?
Administrators should monitor Microsoft’s security update guide and the NVD for official remediation guidance. In the interim, reducing the attack surface is the primary mitigation strategy.
What to do and how to stay safe: Microsoft
- Isolate Windows Server systems running the DHCP service from untrusted networks to limit remote exposure.
- Implement strict network segmentation to ensure that only authorized internal subnets can reach the DHCP server.
- Monitor network traffic for unusual DHCP request patterns that may indicate exploitation attempts.
- Disable the DHCP server role on any Windows Server that does not actively require it for network operations.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-96320?
It is a heap-based buffer overflow vulnerability in the Windows DHCP Server that allows remote code execution.
How severe is this vulnerability?
The National Vulnerability Database rates it as Critical with a CVSS score of 9.8.
Is there a fix available?
The source material does not confirm the availability of a patch or update.
