CVE-2026-77889 Overview
CVE-2026-77889 is a type confusion vulnerability [CWE-843] in Windows DHCP Server. An unauthorized attacker can send crafted network traffic to the DHCP service and cause a denial of service condition. The flaw requires no authentication, no user interaction, and is exploitable across the network.
Because DHCP is a foundational service for IP address assignment, disruption impacts every downstream client that depends on lease renewal. Environments relying on Windows Server DHCP for dynamic addressing will experience broad connectivity loss during exploitation.
Critical Impact
A remote unauthenticated attacker can crash the Windows DHCP Server service, disrupting IP address allocation for all dependent clients on the network.
Affected Products
- Windows DHCP Server (per Microsoft Security Response Center advisory)
- Refer to the Microsoft Security Update CVE-2026-77889 advisory for the authoritative list of affected Windows Server versions and builds
Discovery Timeline
- 2026-09-08 - CVE-2026-77889 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-77889
Vulnerability Analysis
The vulnerability is classified as an access of resource using incompatible type, commonly known as type confusion [CWE-843]. The Windows DHCP Server service interprets a memory region or object as one type when it was allocated or populated as a different type. This mismatch leads to invalid memory access and causes the service to terminate unexpectedly.
Because DHCP handles unauthenticated broadcast and unicast traffic by design, any host able to reach UDP port 67 on the server can trigger the condition. Repeated exploitation prevents the service from staying available, resulting in a sustained denial of service. The impact is limited to availability; confidentiality and integrity are not affected according to the published CVSS vector.
Root Cause
The root cause is improper type validation within DHCP message or option processing. When the service casts or dereferences a structure without verifying that the data matches the expected type, subsequent operations touch invalid memory. Microsoft has not published detailed root-cause internals beyond the CWE-843 classification in the advisory.
Attack Vector
Exploitation requires network access to the DHCP service. An attacker sends a specially crafted DHCP packet, typically to UDP port 67, to trigger the type confusion condition. No credentials or user interaction are needed. Because DHCP frequently accepts broadcast traffic within a subnet, the attack can originate from any device on the same network segment as the DHCP server.
No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-77889
Indicators of Compromise
- Unexpected termination or repeated restarts of the DHCPServer service on Windows Server hosts
- Application or System event log entries recording DHCP service crashes, faulting module dumps, or Windows Error Reporting entries tied to the DHCP process
- Sudden surge in DHCP client lease failures or renewal timeouts across a subnet
Detection Strategies
- Monitor Windows Service Control Manager events for stops and restarts of the DHCP Server service
- Inspect network traffic to UDP port 67 for anomalous or malformed DHCP messages, particularly from unexpected sources
- Correlate DHCP service faults with concurrent inbound DHCP packet patterns to identify triggering traffic
Monitoring Recommendations
- Forward Windows Event Logs from all DHCP servers to a centralized SIEM for continuous availability monitoring
- Alert on any DHCP service crash paired with process exit codes indicative of access violations
- Baseline normal DHCP request volume per subnet and alert on sudden deviations that may signal exploitation attempts
How to Mitigate CVE-2026-77889
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-77889 advisory to all Windows Server hosts running the DHCP Server role
- Inventory all servers running the DHCP Server role and prioritize patching based on exposure and criticality
- Restrict which network segments can reach DHCP servers, limiting exposure to trusted subnets only where feasible
Patch Information
Microsoft has published an official security update for CVE-2026-77889. Refer to the Microsoft Security Update CVE-2026-77889 advisory for update package identifiers and applicable Windows Server versions. Apply the update through Windows Update, WSUS, or your patch management platform.
Workarounds
- Enforce DHCP snooping on managed switches to constrain which ports can send DHCP server traffic and limit rogue traffic reaching the server
- Use host-based firewalls or network ACLs to permit UDP 67 only from authorized DHCP relay agents and clients
- Deploy redundant DHCP servers with split scopes so a single service crash does not halt address allocation subnet-wide
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
