CVE-2026-69297 Overview
CVE-2026-69297 is an information disclosure vulnerability in the Windows Dynamic Host Configuration Protocol (DHCP) Server. The flaw is tracked under [CWE-257] (Storing Passwords in a Recoverable Format). An authorized attacker with low privileges on the network can retrieve stored credentials because the DHCP Server persists passwords in a reversible format. Microsoft rates the issue as medium severity with a CVSS 3.1 base score of 6.5. The vulnerability affects a broad set of supported Windows Server releases and two Windows 10 servicing branches that ship the DHCP Server role.
Critical Impact
An authenticated network attacker can recover sensitive credentials from the Windows DHCP Server, enabling secondary attacks such as lateral movement and privilege escalation.
Affected Products
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
- Microsoft Windows 10 version 1607 (x86 and x64)
- Microsoft Windows 10 version 1809 (x86 and x64)
Discovery Timeline
- 2026-09-08 - CVE-2026-69297 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-69297
Vulnerability Analysis
The Windows DHCP Server stores administrative or service passwords using a reversible encoding rather than a one-way cryptographic hash. An authorized attacker who can reach the DHCP service over the network can request or read these values and reverse them to plaintext. Successful exploitation impacts confidentiality only; integrity and availability of the DHCP service remain unchanged. The attacker does not require user interaction, and the attack complexity is low against a vulnerable server.
Root Cause
The root cause is a design weakness classified as [CWE-257]. Credentials that should be protected with irreversible cryptographic hashing are instead persisted in a format that can be decoded back to their original values. Any principal authorized to access the storage location or the relevant service interface can therefore recover the plaintext password. This weakens the trust boundary between the DHCP role and the credentials it manages.
Attack Vector
Exploitation requires network access to the DHCP Server and valid low-privilege credentials on the target environment. Once authenticated, the attacker queries the service to obtain the stored credential material and reverses it offline. Because DHCP servers frequently run alongside Active Directory infrastructure, harvested credentials can enable follow-on attacks against domain resources, backup accounts, or integrated services. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at time of publication. Microsoft's advisory is available in the Microsoft Security Update Guide.
Detection Methods for CVE-2026-69297
Indicators of Compromise
- Unexpected authenticated RPC or management-interface queries against the DHCP Server from non-administrative hosts.
- Reads of DHCP configuration stores or registry hives containing credential material by unusual user contexts.
- Subsequent authentication attempts using DHCP-related service accounts from workstations that do not normally use them.
Detection Strategies
- Monitor Windows Security event logs on DHCP servers for logon events (4624/4672) from low-privilege accounts followed by access to DHCP management interfaces.
- Baseline normal administrative access to DHCP servers and alert on deviations, particularly interactive or remote access outside change windows.
- Correlate DHCP server access events with subsequent use of recovered service account credentials elsewhere in the environment.
Monitoring Recommendations
- Enable object access auditing on DHCP configuration paths and registry keys that contain stored credentials.
- Forward DHCP server telemetry to a centralized SIEM for correlation with identity and Active Directory activity.
- Review service account usage regularly to detect credentials being reused from unexpected hosts.
How to Mitigate CVE-2026-69297
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows Server and Windows 10 hosts running the DHCP Server role.
- Rotate any credentials that were configured on the DHCP Server prior to patching, including service accounts and integration passwords.
- Restrict network access to the DHCP Server management interfaces to trusted administrative subnets and jump hosts.
Patch Information
Microsoft has released updates that address CVE-2026-69297 across all listed Windows Server versions and both Windows 10 servicing branches. Refer to the Microsoft Security Update Guide for KB article numbers and download links specific to each product build.
Workarounds
- Limit membership in DHCP Administrators and DHCP Users groups to a minimal, audited set of accounts.
- Segment DHCP servers on management VLANs and enforce Windows Firewall rules that allow DHCP protocol traffic while restricting administrative RPC endpoints.
- Use dedicated, least-privilege service accounts for DHCP integrations so that any recovered credential has limited blast radius.
# Configuration example: restrict DHCP administrative access with PowerShell
# Remove non-essential members from the DHCP Administrators group
Remove-LocalGroupMember -Group "DHCP Administrators" -Member "DOMAIN\LegacyAccount"
# Enforce firewall scoping for DHCP server management RPC to trusted admin subnet
Set-NetFirewallRule -DisplayGroup "DHCP Server Management" -RemoteAddress 10.10.20.0/24
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
