CVE-2026-69547: Windows DHCP Server Buffer Overflow Flaw

CVE-2026-69547 Overview

CVE-2026-69547 is a heap-based buffer overflow in the Windows Dynamic Host Configuration Protocol (DHCP) Server service. An authorized attacker can trigger the overflow over a network to execute arbitrary code in the context of the DHCP Server process. Because DHCP servers commonly run with elevated privileges on domain-joined infrastructure, successful exploitation can compromise core network services.

The weakness is classified under CWE-122, Heap-based Buffer Overflow. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Critical Impact
Remote code execution against a Windows DHCP Server can allow an authenticated network attacker to take control of a service that brokers IP addressing for the enterprise, enabling downstream lateral movement and disruption.

Affected Products

Windows DHCP Server (see Microsoft Vulnerability Update CVE-2026-69547 for the current list of affected Windows Server builds)

Discovery Timeline

2026-09-08 - CVE-2026-69547 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-69547

Vulnerability Analysis

The vulnerability resides in how the Windows DHCP Server service processes network-supplied data on the heap. A specially crafted request can cause the service to write beyond an allocated heap buffer, corrupting adjacent memory structures. Because the service handles DHCP messages exchanged with clients and relay agents across the network, the attack surface is exposed to any authenticated actor with reachability to the DHCP service.

Exploitation requires the attacker to hold low-privilege credentials but does not require user interaction. A successful write past the buffer boundary can be shaped to hijack control flow within the DHCP Server process. Impact on confidentiality, integrity, and availability is high because the service typically runs with SYSTEM-equivalent rights on the host.

The EPSS probability is 0.914%, indicating measurable but not widespread near-term exploitation likelihood at the time of publication.

Root Cause

The root cause is improper validation of length or size parameters governing a heap allocation used to parse DHCP protocol data. When crafted input exceeds the assumed bounds, the service writes attacker-controlled bytes into unrelated heap metadata or adjacent objects. This class of defect maps directly to CWE-122.

Attack Vector

The attack vector is network-based. An authenticated attacker sends malformed DHCP protocol traffic to the vulnerable server. Because DHCP infrastructure often sits inside trusted management segments, an initial foothold on any authenticated host with a network path to the DHCP Server is sufficient to attempt exploitation. Refer to the Microsoft Vulnerability Update CVE-2026-69547 for protocol-level detail.

No public proof-of-concept exploit is available at the time of writing.

Detection Methods for CVE-2026-69547

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting (WER) entries for the DHCPServer service on affected hosts.
New or unexpected child processes spawned by svchost.exe hosting the DHCP Server service, particularly command shells or scripting engines.
Anomalous outbound network connections initiated by the DHCP Server host following inbound DHCP traffic bursts.

Detection Strategies

Enable and forward Windows DHCP Server audit logs and Sysmon process, network, and image-load events to a central analytics platform.
Alert on service crashes and stack integrity failures for the DHCP Server process, which are common side effects of failed heap corruption attempts.
Correlate authentication events with subsequent malformed DHCP traffic sourced from the same principal to identify low-privilege accounts probing the service.

Monitoring Recommendations

Baseline normal DHCP request volumes and packet sizes per subnet, then alert on deviations that indicate protocol fuzzing or oversized messages.
Monitor lateral movement indicators originating from DHCP Server hosts, including SMB, WMI, and remote scheduled task creation.
Track patch state for Windows Server DHCP roles and generate alerts when unpatched hosts appear on the network.

How to Mitigate CVE-2026-69547

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Update CVE-2026-69547 advisory to all Windows Server hosts running the DHCP Server role.
Inventory every host with the DHCP Server role enabled and prioritize domain controllers and management-tier servers first.
Rotate credentials for any low-privilege accounts that could reach DHCP Servers if compromise is suspected.

Patch Information

Microsoft has issued a security update through the Microsoft Update channel. Consult the Microsoft Vulnerability Update CVE-2026-69547 advisory for the specific KB article, build numbers, and download links applicable to each supported Windows Server version.

Workarounds

Restrict network reachability to UDP ports 67 and 68 on DHCP Servers using host-based firewall rules and network ACLs so only trusted relay agents and client subnets can communicate.
Segment DHCP infrastructure away from general user networks and require authenticated access paths to management interfaces.
Where feasible, temporarily disable the DHCP Server role on hosts that do not require it until patches are applied.

bash

# Example: restrict inbound DHCP traffic on a Windows Server host firewall
# Allow only specific relay agents to reach the DHCP service
New-NetFirewallRule -DisplayName "DHCP-Server-Allow-Relays" `
    -Direction Inbound -Protocol UDP -LocalPort 67 `
    -RemoteAddress 10.0.0.10,10.0.0.11 -Action Allow

# Block DHCP traffic from all other sources
New-NetFirewallRule -DisplayName "DHCP-Server-Block-Other" `
    -Direction Inbound -Protocol UDP -LocalPort 67 `
    -Action Block