CVE-2026-77499: Windows DHCP Server DOS Vulnerability

CVE-2026-77499 Overview

CVE-2026-77499 is a type confusion vulnerability in the Windows Dynamic Host Configuration Protocol (DHCP) Server. An unauthenticated remote attacker can send crafted DHCP traffic that causes the service to access a resource using an incompatible type, resulting in a denial of service. The flaw is tracked under CWE-843: Access of Resource Using Incompatible Type. Because DHCP is a foundational network service, disruption prevents clients from obtaining or renewing IP address leases across affected network segments.

Critical Impact
A network-adjacent attacker without credentials or user interaction can crash the Windows DHCP Server service, disrupting IP address assignment for all clients that depend on the affected server.

Affected Products

Windows DHCP Server (see the Microsoft Security Update Guide for the authoritative list of affected Windows Server builds)

Discovery Timeline

2026-09-08 - CVE-2026-77499 published to the National Vulnerability Database
2026-09-08 - Last updated in the NVD database

Technical Details for CVE-2026-77499

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server service, which handles lease requests and options for network clients. The service mishandles a data structure by treating it as a type incompatible with its actual layout. When the mismatched access occurs, the resulting memory access aborts service execution and terminates the DHCP process.

The attack requires no privileges and no user interaction. Exploitation targets availability only; confidentiality and integrity are not affected. The Exploit Prediction Scoring System places CVE-2026-77499 in the mid-range of near-term exploitation likelihood, and no public exploit or in-the-wild activity has been reported at publication time.

Root Cause

Type confusion vulnerabilities occur when code interprets an object of one type as another without validating the actual type. In this case, the DHCP Server dereferences a field or pointer under an assumption about its structure that a crafted DHCP message can violate. The resulting invalid access triggers a fault that the service cannot recover from cleanly.

Attack Vector

An attacker sends a crafted DHCP packet across the network to UDP port 67 on a vulnerable Windows DHCP Server. The malicious message drives the parser through the code path that performs the incompatible-type access. Because DHCP relay agents forward DHCP traffic across subnets, an attacker outside the local broadcast domain can still reach a server through misconfigured or intentionally traversed relays.

No verified proof-of-concept code is available. Technical details are described in the Microsoft Security Update Guide for CVE-2026-77499.

Detection Methods for CVE-2026-77499

Indicators of Compromise

Unexpected termination of the DHCPServer service on Windows Server hosts
Windows Event Log entries showing service crashes, application faults in dhcpssvc.dll, or Service Control Manager events for repeated DHCP service restarts
Sudden inability of clients to obtain or renew IPv4 leases from an otherwise healthy server

Detection Strategies

Monitor Windows Event Logs for Event ID 7031 and 7034 tied to the DHCP Server service, along with Application Error events referencing DHCP binaries
Inspect DHCP audit logs under %SystemRoot%\System32\DHCP\ for anomalous or malformed request patterns preceding a service outage
Correlate network telemetry for bursts of malformed DHCP messages sourced from unexpected internal addresses or across relay boundaries

Monitoring Recommendations

Alert on repeated restarts of the DHCPServer service within a short interval on any Windows Server
Track DHCP lease issuance rates and alert on sudden drops that correlate with server-side faults
Baseline DHCP traffic patterns at the network layer and flag anomalies such as oversized options or malformed message types reaching UDP port 67

How to Mitigate CVE-2026-77499

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-77499 to every Windows Server running the DHCP Server role
Inventory all authoritative DHCP servers and confirm they are covered by the current patch cycle
Configure automatic recovery for the DHCP service so brief outages do not turn into extended downtime while patching is planned

Patch Information

Microsoft has published fix guidance under the Security Update Guide entry for CVE-2026-77499. Administrators should install the corresponding cumulative update on all Windows Server systems that host the DHCP Server role and verify the update via Windows Update history or the Get-HotFix cmdlet.

Workarounds

Restrict UDP port 67 traffic at network boundaries so only trusted subnets and DHCP relay agents can reach DHCP servers
Enforce DHCP snooping and rate limiting on managed switches to reduce exposure to malformed broadcast traffic
Deploy redundant DHCP servers with split scopes or failover so that a crash on one server does not eliminate lease services for clients

bash

# Verify the CVE-2026-77499 security update is installed on a Windows DHCP server
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Confirm the DHCP Server service is running and configured to auto-restart on failure
sc.exe qc DHCPServer
sc.exe failure DHCPServer reset= 86400 actions= restart/60000/restart/60000/restart/60000