Windows DHCP Server: Spoofing due to improper access control

Summary

Improper access control in the DHCP Server role of Windows Server allows an unauthorized attacker on the network to perform spoofing. Microsoft rates the impact as low integrity only (CVSS 5.3), with no confidentiality or availability loss. No authentication is required, but a practical attack usually needs a position on the same LAN segment as the DHCP server or its clients.

Affected

• Windows Server 2016 and Server Core installation: builds 10.0.14393.0 before 10.0.14393.9688
• Windows Server 2019 and Server Core installation: builds 10.0.17763.0 before 10.0.17763.9487
• Windows Server 2022: builds 10.0.20348.0 before 10.0.20348.5870
• Windows Server 2025 and Server Core installation: builds 10.0.26100.0 before 10.0.26100.33822
• Windows 10 editions are not listed in the CVE record.

Fixed in

• Install the November 2026 security update for the affected Windows Server edition, which contains builds 10.0.14393.9688, 10.0.17763.9487, 10.0.20348.5870 and 10.0.26100.33822 or later.
• For Server 2019, KB5131085 is reported by a third-party page; verify the KB number on the MSRC page.
• KB numbers for Server 2016, 2022 and 2025 are unknown; check the MSRC page.

Workaround

• No workaround from Microsoft is known.
• General hardening (not from the advisory): enable DHCP snooping on managed switches so that only trusted ports can send DHCP server responses.
• Place DHCP clients and the DHCP server in a protected VLAN.

Exploitation

• Microsoft assesses exploit maturity as unproven (E:U); no publicly available exploit code is known for this CVE.
• CISA SSVC lists exploitation as none, with automatable: yes and technical impact: partial.
• The CVE is not listed in CISA KEV and is not tied to known exploitation according to a third-party release summary.

Our recommendation

• Apply the November 2026 security update on all affected Windows Server systems in the normal monthly patch cycle.
• Prioritise servers with the DHCP role on flat networks with guest or IoT devices, or without DHCP snooping.
• Enable DHCP snooping and separate DHCP clients into protected VLANs as an interim measure.
• Check whether DHCP runs on a Windows Server; systems where DHCP runs on a firewall, router or NAS are less affected.
• Monitor for unusual DHCP traffic or rogue DHCP server responses.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-113773 msrc.microsoft.com
• CVE Record CVE-2026-113773 www.cve.org
• Release summary for KB5131085 (third-party) senserva.com
• CAPEC-697: DHCP spoofing capec.mitre.org
• MITRE ATT&CK T1557.003: DHCP Spoofing attack.mitre.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:33.