CVE-2026-69497: Windows 10 1607 DHCP Server DOS Vulnerability

CVE-2026-69497 Overview

CVE-2026-69497 is a memory leak vulnerability in Windows DHCP Server that allows an authenticated attacker to trigger a denial of service condition over the network. The flaw stems from missing release of memory after effective lifetime [CWE-401], causing resource exhaustion when specific DHCP requests are processed. Microsoft published the advisory in the Security Update Guide, confirming impact across multiple supported Windows client and server releases. Successful exploitation degrades availability of the DHCP service, disrupting IP address allocation for downstream clients.

Critical Impact
An authenticated network attacker can exhaust memory on Windows DHCP Server hosts, causing loss of DHCP service availability across the affected network segment.

Affected Products

Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Microsoft Windows 10 version 1607 (x64 and x86)
Microsoft Windows 10 version 1809 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-69497 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69497

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which manages dynamic IP address assignment via the Dynamic Host Configuration Protocol. The defect is a memory leak tracked under [CWE-401] Missing Release of Memory After Effective Lifetime. When the DHCP service processes certain requests from an authenticated attacker, allocated memory buffers are not freed after their intended lifetime ends. Repeated requests progressively consume server memory until the service cannot allocate resources needed to respond to legitimate client requests.

Because DHCP underpins network connectivity for endpoints, printers, and IoT devices, a sustained exhaustion condition prevents clients from obtaining or renewing leases. The Microsoft advisory classifies this issue as an availability impact only, with no confidentiality or integrity consequences.

Root Cause

The root cause is an object lifetime management defect in the DHCP Server implementation. Allocated memory associated with request processing is never released back to the heap, producing an unbounded growth pattern under attacker-controlled request volume.

Attack Vector

Exploitation requires network reachability to UDP port 67 on the affected DHCP server and low-privilege authenticated access. The attacker issues a sustained series of crafted DHCP requests that trigger the leaking code path. No user interaction is required, and the attack complexity is low. Because DHCP servers typically serve broad internal segments, exposure inside enterprise networks is substantial once an attacker gains any authenticated foothold.

Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-69497

Indicators of Compromise

Progressive, unexplained growth of the svchost.exe process hosting the DHCP Server service (dhcpserver) working set and private bytes.
DHCP scope statistics showing rising unfulfilled lease requests while the server remains reachable.
Windows Event Log entries from source DhcpServer indicating resource allocation failures or service unresponsiveness.

Detection Strategies

Monitor DHCP server memory utilization over time and alert on sustained upward trends that do not correlate with client population growth.
Correlate high volumes of DHCP DISCOVER, REQUEST, or INFORM messages from a single authenticated source with memory pressure on the server.
Baseline normal DHCP transaction rates per subnet and flag statistical anomalies against that baseline.

Monitoring Recommendations

Ingest Windows DHCP Server audit logs (%windir%\System32\dhcp\DhcpSrvLog-*.log) into a centralized log platform for retention and analysis.
Track performance counters under DHCP Server including Packets Received/sec, Duplicates Dropped/sec, and Active Queue Length.
Alert on DHCP service restarts, crashes, or state transitions reported through the Service Control Manager.

How to Mitigate CVE-2026-69497

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows Server and Windows 10 hosts running the DHCP Server role.
Inventory DHCP servers across the estate and prioritize domain-critical and datacenter DHCP infrastructure for patching first.
Restrict authenticated network access to DHCP servers to trusted management ranges where operationally feasible.

Patch Information

Microsoft has released fixes through the standard Windows security update channels. Consult the Microsoft Security Update Guide entry for the specific KB numbers applicable to each Windows Server and Windows 10 build listed in the affected products.

Workarounds

Deploy DHCP failover or split-scope configurations so a memory-exhausted primary server fails over to a healthy partner while remediation is applied.
Configure resource-based process recycling or scheduled restarts of the DHCP Server service to reclaim leaked memory in environments where immediate patching is not possible.
Enforce network segmentation and firewall policy to limit which authenticated hosts can reach the DHCP Server service on UDP port 67.

bash

# Example: enable DHCP failover between two Windows Server DHCP hosts (PowerShell)
Add-DhcpServerv4Failover -ComputerName "dhcp01.contoso.local" `
  -PartnerServer "dhcp02.contoso.local" `
  -Name "Site1-Failover" `
  -ScopeId 10.10.0.0 `
  -SharedSecret "<secret>" `
  -LoadBalancePercent 50