Windows DHCP Server: Remote code execution via stack-based buffer overflow

Summary

A stack-based buffer overflow in the Windows DHCP Server role allows an authorized attacker to execute code over the network. The NVD score is 8.8 (CVSS 3.1), with high impact on confidentiality, integrity and availability. Exploitation requires low privileges and network access to the DHCP service, so the risk is mainly on internal networks, especially flat ones.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows Server 2012 and Server Core (6.2.9200.0 to below 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016 and Server Core (10.0.14393.0 to below 10.0.14393.9612)
• Windows Server 2019 and Server Core (10.0.17763.0 to below 10.0.17763.9376)
• Windows Server 2022 (10.0.20348.0 to below 10.0.20348.5761)
• Windows Server 2025 and Server Core (10.0.26100.0 to below 10.0.26100.33650)

Fixed in

Fixed by Microsoft's October 2026 security updates. Per the CVE record, the first fixed builds are 10.0.14393.9612, 10.0.17763.9376, 6.2.9200.26434, 6.3.9600.23470, 10.0.20348.5761 and 10.0.26100.33650. Reported KB numbers (to be verified against MSRC): Windows 10 1607 and Server 2016 KB5126868; Windows 10 1809 and Server 2019 KB5126651; Windows Server 2022 KB5126655; Windows Server 2025 KB5126646; Windows Server 2012 R2 KB5126836. Confirm the exact KB for Server 2012 for each system.

Workaround

Unknown. No vendor workaround was found. Restricting DHCP to trusted network segments and limiting access to DHCP servers reduces exposure until patching is complete.

Exploitation

• No public proof-of-concept exploit found.
• No evidence of in-the-wild exploitation found.
• CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.
• Tenable plugins for the October 2026 bulletins carry an 'exploit available' flag and, for 1809, a CISA KEV due date of 10/16/2026. These flags apply to the bulletin as a whole and could not be linked to this CVE. Check the CISA KEV catalog directly.

Our recommendation

• Apply the October 2026 cumulative update to all DHCP servers (Server 2012 R2 to 2025) and confirm the fixed build via the MSRC Security Update Guide.
• Until patched, restrict DHCP service access to trusted segments and audit who can reach DHCP servers.
• Prioritize patching if the DHCP role runs on a domain controller or other critical systems.
• Monitor DHCP servers for unusual activity and check the CISA KEV catalog for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70069 msrc.microsoft.com
• NVD record via Vulners: CVE-2026-70069 vulners.com
• Vulnrichment (CISA ADP) via Vulners: CVE-2026-70069 vulners.com
• OpenCVE: CVE-2026-70069 app.opencve.io
• Tenable plugin 365471 (Windows 10 1607 / Server 2016, October 2026) www.tenable.com
• Tenable plugin 365475 (Windows 10 1809 / Server 2019, October 2026) www.tenable.com
• Tenable plugin 365470 (Windows Server 2022, October 2026) www.tenable.com
• Senserva KB 5126836 (Windows Server 2012 R2) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:00.