IT SBIT Services
Schneeberger
DEEN
CVE tracker

Windows DHCP Server: Use after free allows local privilege escalation

CVE-2026-70066High 7.0

← All vulnerabilities

Summary

Microsoft Windows DHCP Server contains a use-after-free vulnerability (CWE-416) in the server-side DHCP component. An authorized local user can exploit it to elevate privileges. Exploitation requires local access and low privileges, and the attack complexity is high. The flaw is not reachable directly from the internet.

Affected

  • Windows 10 Version 1607: 10.0.14393.0 before 10.0.14393.9612
  • Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9376
  • Windows Server 2012 (incl. Server Core): 6.2.9200.0 before 6.2.9200.26434
  • Windows Server 2012 R2 (incl. Server Core): 6.3.9600.0 before 6.3.9600.23470
  • Windows Server 2016 (incl. Server Core): 10.0.14393.0 before 10.0.14393.9612
  • Windows Server 2019 (incl. Server Core): 10.0.17763.0 before 10.0.17763.9376
  • Windows Server 2022: 10.0.20348.0 before 10.0.20348.5761 (per CNA record; not confirmed by vendor advisory)
  • Windows Server 2025 (incl. Server Core): 10.0.26100.0 before 10.0.26100.33650

Fixed in

  • Install the October 2026 cumulative update or the latest Microsoft update addressing CVE-2026-70066.
  • Windows 10 1607 / Server 2016: OS Build 14393.9612 (KB5126868, released 2026-10-13), to be confirmed on MSRC.
  • Other fixed builds: see the affected list above.
  • Windows 10 Version 1607 Enterprise LTSB: no further security updates after 13 Oct 2026 unless ESU is active.

Workaround

  • Disable the DHCP Server role on systems that do not need it, or move the role to another system.
  • Restrict the DHCP server to a segment with limited access.
  • Restrict local logon on DHCP servers to administrators.
  • Windows 10 1607 without ESU: no official workaround known. Upgrade or enrol in ESU.

Exploitation

  • Exploited in the wild: No evidence found.
  • CISA KEV: not listed.
  • CISA SSVC: exploitation none, automatable no, technical impact total.
  • EPSS: 0.0027 (about 0.27%).
  • Public proof-of-concept exploit: none found.

Our recommendation

  • Inventory all hosts that run the Windows DHCP Server role.
  • Install the October 2026 cumulative update on these hosts first.
  • Move Windows 10 1607 devices to a supported operating system or enrol them in ESU.
  • Plan the migration of Windows Server 2016 before extended support ends on 12 January 2027.
  • Restrict local logon on DHCP servers to administrators and monitor for suspicious local activity.
  • Verify on the MSRC advisory which configurations are actually vulnerable.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Windows DHCP Server
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation unlikely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126651, KB5126655, KB5126646, KB5126868, KB5126835, KB5126836

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:16.

Original description (NVD)

Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed