Windows DHCP Server: Denial of service through uncontrolled resource consumption
Summary
Windows Server with the DHCP Server role is affected by a denial-of-service vulnerability caused by uncontrolled resource consumption. An unauthorized attacker on the network can disrupt the DHCP service, which can interrupt IP address assignment for clients. No authentication or user interaction is required, but the attacker needs network access to the DHCP server, typically from the internal LAN.
Affected
- Windows Server 2016 and Server 2016 Server Core: before 10.0.14393.9688
- Windows Server 2019 and Server 2019 Server Core: before 10.0.17763.9487
- Windows Server 2022: before 10.0.20348.5870
- Windows Server 2025 and Server 2025 Server Core: before 10.0.26100.33822
Fixed in
- Install the November 2026 cumulative update for the affected Windows Server version. The CVE record lists the builds above as the fixed versions; verify them on the MSRC advisory, which could not be accessed during research.
- Action1 names KB5131291 (Server 2016) and KB5131085 (Server 2019) for the November 2026 updates. No source explicitly links these KBs to this CVE.
Workaround
- Unknown. No official workaround found.
- Until patched, restrict access to the DHCP service to the internal LAN segments.
Exploitation
- No known exploitation in the wild.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Identify all Windows Server hosts with the DHCP Server role, including Server Core installations.
- Install the November 2026 cumulative update and check the resulting build against the MSRC advisory.
- Restrict DHCP to the internal LAN and do not expose it to the internet.
- Patch together with the other DHCP Server fixes in the same release.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Denial of service – Windows DHCP Server
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131090, KB5131080, KB5131077
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org record (Microsoft CNA) www.cve.org
- MSRC Security Update Guide (not accessed during research) msrc.microsoft.com
- Strix CVE summary (aggregator) www.strix.ai
- Action1 November 2026 Patch Tuesday review www.action1.com
- Securityonline critical Windows vulnerabilities November 2026 securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:04.
Original description (NVD)
Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.