CVE-2026-77494: Windows DHCP Server DOS Vulnerability

CVE-2026-77494 Overview

CVE-2026-77494 is a type confusion vulnerability in the Windows DHCP Server service. An unauthenticated attacker can send crafted network traffic to trigger the flaw and deny service to legitimate DHCP clients. The weakness is tracked under CWE-843: Access of Resource Using Incompatible Type.

The vulnerability requires no privileges and no user interaction. Successful exploitation disrupts IP address allocation across affected network segments, preventing clients from obtaining or renewing leases.

Critical Impact
Remote, unauthenticated denial of service against Windows DHCP Server, capable of breaking client connectivity across entire subnets that rely on the affected service.

Affected Products

Windows DHCP Server (see Microsoft Security Update Guide for the authoritative list of affected Windows Server builds)

Discovery Timeline

2026-09-08 - CVE-2026-77494 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77494

Vulnerability Analysis

The Windows DHCP Server service processes incoming DHCP messages and dispatches them through internal handlers. The vulnerability occurs when the service accesses a resource using a type that does not match its actual type. This type confusion condition corrupts execution state within the DHCP Server process.

The result is a service crash that halts DHCP request processing. Clients on affected subnets cannot obtain new leases or renew existing ones once the service becomes unavailable. The impact is confined to service availability; the advisory does not report confidentiality or integrity impact.

The EPSS model estimates a 1.2% probability of exploitation activity within the next 30 days.

Root Cause

The root cause is improper type handling in the DHCP Server request path, categorized as [CWE-843]. The service interprets a memory object as one type while it was allocated or populated as another. This mismatch leads to invalid field access and a resulting fault in the DHCP Server process.

Attack Vector

The attack vector is network-based. An attacker sends a crafted DHCP message to a reachable Windows DHCP Server. No authentication or user interaction is required. Because DHCP typically operates on local broadcast domains and relay-forwarded traffic, attackers with any foothold in a routable segment that reaches port UDP/67 on the server can attempt exploitation.

No public proof-of-concept exploit is currently listed. Refer to the Microsoft Security Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2026-77494

Indicators of Compromise

Unexpected termination or repeated restarts of the DHCPServer service on Windows Server hosts.
Windows Event Log entries indicating a crash in the DHCP Server process, including Service Control Manager events for DHCPServer state changes.
Surge of DHCP client failures (DHCPDISCOVER retransmissions, DHCPNAK responses missing) reported by endpoints or SIEM telemetry.
Malformed DHCP packets originating from unexpected internal hosts observed in network captures.

Detection Strategies

Monitor Windows Service state transitions for the DHCPServer service and alert on unplanned stops or restart loops.
Baseline normal DHCP transaction volume and alert on sudden drops in successful lease grants, which indicate service disruption.
Inspect DHCP traffic at the network layer for malformed option fields, oversized payloads, or protocol violations targeting UDP/67.

Monitoring Recommendations

Forward DHCP Server operational and audit logs to a central log platform for correlation with service crash events.
Track host-level process telemetry for svchost.exe instances hosting the DHCP Server role and alert on abnormal termination.
Correlate client-side lease acquisition failures across endpoints to identify server-side unavailability early.

How to Mitigate CVE-2026-77494

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Windows Servers running the DHCP Server role.
Inventory all DHCP Server instances, including those on domain controllers and branch-office servers, to confirm patch coverage.
Restrict network reachability to UDP/67 on DHCP servers so that only trusted VLANs and DHCP relay agents can send traffic.

Patch Information

Microsoft has published the fix through the Security Update Guide. Consult the Microsoft advisory for CVE-2026-77494 for the specific KB article, affected builds, and update packages applicable to your Windows Server versions.

Workarounds

Enforce DHCP snooping on managed switches to drop malformed DHCP traffic from untrusted ports.
Deploy DHCP failover or split-scope configurations so that a crash on one server does not sever client connectivity.
Limit the network segments allowed to reach DHCP servers using access control lists on routers and firewalls.

bash

# Configuration example: restrict DHCP traffic to trusted relay agents (Windows Firewall)
New-NetFirewallRule -DisplayName "Allow DHCP from trusted relays" `
  -Direction Inbound -Protocol UDP -LocalPort 67 `
  -RemoteAddress 10.0.0.0/24,10.0.1.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block DHCP from untrusted sources" `
  -Direction Inbound -Protocol UDP -LocalPort 67 -Action Block