CVE-2026-77890: Windows DHCP Server DoS Vulnerability

CVE-2026-77890 Overview

CVE-2026-77890 is a type confusion vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. An unauthenticated attacker can send crafted network traffic to a vulnerable DHCP Server and trigger a denial-of-service (DoS) condition. The flaw is tracked under CWE-843: Access of Resource Using Incompatible Type. Exploitation requires no user interaction and no privileges, and the attack is reachable over the network. Microsoft documents the issue in the Microsoft Security Update Guide.

Critical Impact
A remote, unauthenticated attacker can crash the Windows DHCP Server service, disrupting IP address assignment for every client that depends on it.

Affected Products

Microsoft Windows Server with the DHCP Server role enabled
Specific affected build ranges: see the Microsoft Security Update Guide advisory for CVE-2026-77890
Environments where Windows DHCP Server provides IP leases to enterprise clients

Discovery Timeline

2026-09-08 - CVE-2026-77890 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77890

Vulnerability Analysis

The vulnerability is a type confusion flaw (CWE-843) in the Windows DHCP Server service. Type confusion occurs when code accesses a resource assuming one data type, while the resource is actually a different, incompatible type. In this case, the DHCP Server processes a network-supplied structure using the wrong type interpretation, leading to invalid memory access and service termination.

The impact is confined to availability. Successful exploitation crashes the DHCP Server service and blocks lease renewals and new address assignments. Clients that cannot obtain or renew leases lose network connectivity, which magnifies the impact in large environments and remote sites.

Root Cause

The root cause is improper validation of the type or format of an object referenced during DHCP message processing. When the service casts or dereferences the object using an incompatible type, memory is interpreted incorrectly and the process faults. No authentication path guards this code, which is why an unauthenticated attacker can reach it.

Attack Vector

The attack vector is network based. An attacker on any network segment that can reach UDP port 67 on the DHCP Server can send a crafted DHCP request or option payload to trigger the type confusion. Attack complexity is low and no user interaction is required. Because DHCP traffic is often broadcast within a subnet and relayed across segments by DHCP relay agents, exposure typically extends beyond the immediate broadcast domain.

No public proof-of-concept exploit is currently listed for CVE-2026-77890. See the Microsoft Security Update Guide for technical details.

Detection Methods for CVE-2026-77890

Indicators of Compromise

Unexpected termination or repeated restarts of the DHCPServer service on Windows Server hosts
Windows Event Log entries showing Service Control Manager crashes for the DHCP Server service
Spikes in inbound DHCP traffic (UDP/67) from a single source or spoofed MAC addresses
Sudden increase in clients failing to obtain or renew DHCP leases across one or more subnets

Detection Strategies

Alert on crash and auto-restart events for the DHCP Server service in the Windows System event log
Correlate DHCP traffic anomalies (malformed options, oversized packets) with DHCP service errors
Monitor network telemetry for high-rate DHCPDISCOVER or DHCPREQUEST bursts targeting DHCP servers

Monitoring Recommendations

Ingest Windows Event IDs 7031, 7034, and DHCP-Server operational logs into a central SIEM for correlation
Track DHCP scope statistics and alert on abrupt drops in successful lease grants
Baseline normal DHCP traffic volumes at server interfaces and flag deviations for investigation

How to Mitigate CVE-2026-77890

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-77890
Inventory all Windows Servers with the DHCP Server role and prioritize patching for internet-adjacent or shared-subnet servers
Enable service recovery options so the DHCP Server service restarts automatically after a crash while patching proceeds

Patch Information

Microsoft has published a fix through the Security Update Guide. Administrators should install the update on every Windows Server running the DHCP Server role and validate that the service starts cleanly after reboot. Confirm the installed KB matches the version listed in the advisory for the target Windows Server build.

Workarounds

Restrict DHCP traffic (UDP/67 and UDP/68) at network boundaries so only trusted relay agents and clients can reach DHCP servers
Deploy redundant DHCP servers with split scopes or failover to preserve lease availability if one server is crashed
Rate-limit DHCP traffic on switches and firewalls to reduce the impact of malformed packet floods

bash

# Example: verify DHCP Server service state and enable automatic recovery on Windows Server
Get-Service DHCPServer
sc.exe failure DHCPServer reset= 86400 actions= restart/5000/restart/5000/restart/5000