CVE-2026-58627 Overview
CVE-2026-58627 is an uncontrolled resource consumption vulnerability in the Microsoft Windows Dynamic Host Configuration Protocol (DHCP) Server service. An unauthenticated remote attacker can send crafted DHCP traffic that exhausts server resources, causing the service to stop responding to legitimate address lease requests. The flaw is classified under [CWE-400] and affects Windows client and server editions ranging from Windows 10 1607 to Windows Server 2025.
Critical Impact
A successful attack disrupts DHCP address assignment across an affected network segment, preventing clients from obtaining or renewing IP leases and interrupting connectivity for dependent services.
Affected Products
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
- Microsoft Windows 10 version 1607 (x64 and x86)
- Microsoft Windows 10 version 1809 (x64 and x86)
Discovery Timeline
- 2026-07-14 - CVE-2026-58627 published to the National Vulnerability Database
- 2026-07-17 - Last updated in the NVD database
Technical Details for CVE-2026-58627
Vulnerability Analysis
The vulnerability resides in the Windows DHCP Server service, which processes DHCPDISCOVER, DHCPREQUEST, and related client messages on UDP port 67. Improper limits on resource allocation during message handling allow an attacker to trigger uncontrolled consumption of memory, CPU, or handles. Sustained abuse renders the service unresponsive and prevents new lease negotiation.
The attack requires no authentication and no user interaction. Because DHCP is a foundational network service, disruption cascades to endpoints that depend on dynamic addressing, including workstations, VoIP devices, and printers. The impact is limited to availability; confidentiality and integrity are not affected.
Root Cause
The root cause is an uncontrolled resource consumption weakness [CWE-400] in the DHCP Server message processing path. The service fails to enforce sufficient rate or quota controls when handling adversarial input volumes or malformed sequences, allowing a single unauthenticated network source to exhaust server capacity.
Attack Vector
Exploitation occurs over the network. An attacker with reachability to UDP port 67 on the DHCP server sends a stream of crafted DHCP messages that force the service into resource-heavy code paths. Because DHCP traffic traverses broadcast domains and can be relayed across subnets via DHCP relay agents, the exposure often extends beyond a single VLAN.
No verified public proof-of-concept code is available for CVE-2026-58627 at the time of publication. Refer to the Microsoft Security Response Center advisory for authoritative technical details.
Detection Methods for CVE-2026-58627
Indicators of Compromise
- Abnormally high volumes of DHCPDISCOVER or DHCPREQUEST packets originating from a single MAC address, IP address, or relay agent.
- Repeated dhcpssvc.dll crash events, Service Control Manager errors, or DHCP Server event log warnings indicating pool exhaustion or thread starvation.
- Sudden increase in svchost.exe memory or handle count on the DHCP server host.
- Client-side failures showing APIPA 169.254.0.0/16 addresses across a subnet.
Detection Strategies
- Monitor the Windows Event Log channels Microsoft-Windows-DHCP-Server/Operational and Microsoft-Windows-DHCP-Server/Admin for scope exhaustion, service restart, and processing error events.
- Baseline normal DHCP request rates per client and alert on statistically significant deviations at the network sensor or NetFlow layer.
- Correlate DHCP server CPU, memory, and lease pool telemetry with inbound UDP/67 traffic volumes to identify resource pressure caused by external input.
Monitoring Recommendations
- Ingest DHCP server performance counters and event logs into a centralized SIEM for continuous analysis.
- Alert on repeated service restarts of the DHCPServer service within short time windows.
- Track lease grant failure rates and unusually short lease durations across scopes as early indicators of stress or attack.
How to Mitigate CVE-2026-58627
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-58627 to all affected Windows Server and Windows 10 systems running the DHCP Server role.
- Restrict UDP port 67 exposure to trusted network segments and enforce DHCP snooping on managed switches to drop rogue traffic.
- Review DHCP relay agent configurations to ensure only authorized subnets forward client requests to the server.
Patch Information
Microsoft has published guidance and updates through the Microsoft Update Guide. Administrators should install the vendor-supplied patch corresponding to each affected build listed in the Microsoft CVE-2026-58627 Update. Prioritize domain controllers and infrastructure servers that also host the DHCP Server role.
Workarounds
- Enable DHCP snooping and port rate limiting on access switches to constrain broadcast-based request floods.
- Deploy redundant DHCP servers with split scopes so that failure of one instance does not eliminate address assignment for the segment.
- Where feasible, segment DHCP servers behind firewalls that enforce per-source rate limits on UDP/67 traffic.
# Example: constrain DHCP Server service recovery to auto-restart on failure
sc.exe failure DHCPServer reset= 86400 actions= restart/60000/restart/60000/restart/60000
# Example: verify current DHCP Server service state
Get-Service -Name DHCPServer | Format-List Name,Status,StartType
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
