Heap-based buffer overflow in Windows DHCP Server

CVE-2026-69845 is a heap-based buffer overflow in the Windows DHCP Server service. An unauthenticated attacker on the same network segment can send specially crafted DHCP packets to trigger the overflow and achieve arbitrary code execution as SYSTEM. The flaw affects Windows Server editions running the DHCP Server role — Server 2016, 2019, 2022, and 2025 are all in scope. A companion vulnerability, CVE-2026-72979, targets the same attack surface with a use-after-free. Both were patched in the September 2026 Patch Tuesday cycle.

Microsoft stamped this CRITICAL / 9.8 with a CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector, but the AV:N designation is misleading. DHCP operates on UDP port 67, a broadcast/LAN protocol that is not routable across the internet by design. No legitimate enterprise exposes DHCP to the WAN. The real attack vector is *adjacent network* (AV:A), which would drop the CVSS to roughly 8.8. Microsoft itself rates exploitation as "Less Likely", there is no public PoC, no KEV listing, and no observed in-the-wild activity. The vendor severity overstates the reachability, but the *impact* — SYSTEM on infrastructure — is accurately severe.

Why this verdict

• LAN-only protocol caps reachability. DHCP operates on UDP/67, a broadcast protocol that does not traverse routers or the internet. The CVSS AV:N is technically correct but practically misleading — the real attack vector is adjacent network (AV:A). This single factor removes the entire remote-unauthenticated-over-internet threat model that justifies a 9.8.
• No public exploit lowers immediacy. There is no PoC, no exploit code, and Microsoft rates exploitation as "Less Likely." Weaponizing a heap overflow on modern Windows Server with ASLR, CFG, and CET requires significant attacker investment. This is not a spray-and-pray vulnerability.
• Role multiplier: DHCP server is infrastructure, sometimes co-hosted on DCs. (a) *Low-value role:* N/A — DHCP Server is not installed on workstations. (b) *Typical role:* Dedicated member server running DHCP — compromise yields SYSTEM on one infrastructure host with ability to poison DHCP options for the subnet. Blast radius: subnet-scale MITM. (c) *High-value role:* DHCP co-hosted on a domain controller (common in SME/branch offices, estimated 10-20% of AD deployments) — SYSTEM on DC = immediate domain compromise, fleet-scale blast radius. This high-value-role outcome floors the verdict at HIGH.

Why not higher?

Upgrading to CRITICAL would require either active exploitation, a public PoC lowering the exploitation bar, or internet-facing exposure. None of these conditions exist. The attack requires prior internal network access (post-initial-access), the exploit complexity for a heap overflow on modern Windows is non-trivial, and Microsoft's own assessment is "Exploitation Less Likely." The floor analysis keeps this at HIGH but the friction prevents it from reaching CRITICAL.

Why not lower?

Dropping to MEDIUM would ignore the blast radius. DHCP servers run as SYSTEM on infrastructure hosts that configure every endpoint's network stack. The co-hosting-on-DC scenario (estimated 10-20% of deployments) means successful exploitation can end in domain takeover. The vulnerability is unauthenticated once on-network, requires zero user interaction, and the DHCP protocol has no authentication mechanism — there is no credential barrier. The role-multiplier floor keeps this firmly at HIGH.

1. Segment DHCP servers onto dedicated management VLANs — Restrict which hosts can reach UDP/67 on the DHCP server to only DHCP relay agents and authorized admin workstations. This eliminates the attack surface from compromised user endpoints. Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Deploy IDS/IPS signatures for malformed DHCP traffic — Enable Snort SIDs 67011-67032, 67036-67084 (Snort 2) or 301619-301655 (Snort 3) to detect and block exploit attempts targeting the DHCP service. These should be deployed on sensors monitoring infrastructure VLANs.
3. Separate DHCP Server role from Domain Controllers — If DHCP is currently co-hosted on DCs, migrate the role to dedicated member servers. This reduces the blast radius from domain-takeover to single-host compromise. This is a best-practice architectural change that should be prioritized for any environment where it hasn't been done.
4. Enable DHCP Snooping on managed switches — DHCP Snooping validates DHCP messages and rate-limits DHCP traffic on untrusted ports. While it primarily defends against rogue DHCP servers, it also limits an attacker's ability to interact with the DHCP service from arbitrary switch ports.
5. Ensure EDR coverage on DHCP server hosts — EDR agents should be active on all infrastructure servers including DHCP. Behavioral detection for anomalous process creation from svchost.exe hosting the DHCP service would catch post-exploitation activity.

Run this on each Windows Server that might have the DHCP Server role installed. Execute in an elevated PowerShell session (Run as Administrator). No external dependencies required. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-69845.ps1

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-69845.ps1
  Checks whether the Windows DHCP Server role is installed and whether
  the September 2026 cumulative update has been applied.
#>

$VulnCVE = 'CVE-2026-69845'

# Step 1: Check if DHCP Server role is installed
$dhcpFeature = Get-WindowsFeature -Name DHCP -ErrorAction SilentlyContinue
if (-not $dhcpFeature -or $dhcpFeature.InstallState -ne 'Installed') {
    Write-Host "PATCHED — DHCP Server role is not installed. $VulnCVE does not apply to this host."
    exit 0
}

Write-Host "[!] DHCP Server role is INSTALLED on this host."

# Step 2: Check if DHCP Server service is running
$dhcpSvc = Get-Service -Name DHCPServer -ErrorAction SilentlyContinue
$svcRunning = $dhcpSvc -and $dhcpSvc.Status -eq 'Running'

# Step 3: Check for September 2026 patches
# Look for cumulative updates dated 2026-09 or later
$patchDate = [DateTime]'2026-09-08'
$recentPatches = Get-HotFix | Where-Object {
    $_.InstalledOn -ge $patchDate
} | Sort-Object InstalledOn -Descending

if ($recentPatches.Count -gt 0) {
    $latestKB = $recentPatches[0].HotFixID
    $latestDate = $recentPatches[0].InstalledOn.ToString('yyyy-MM-dd')
    Write-Host "PATCHED — DHCP Server role is installed but September 2026 update ($latestKB, installed $latestDate) is present."
    exit 0
} else {
    $lastPatch = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
    $lastDate = if ($lastPatch) { $lastPatch.InstalledOn.ToString('yyyy-MM-dd') } else { 'UNKNOWN' }
    $runningSuffix = if ($svcRunning) { ' and service is ACTIVELY RUNNING' } else { ' (service is stopped but role is installed)' }
    Write-Host "VULNERABLE — DHCP Server role is installed$runningSuffix. Last patch installed: $lastDate. September 2026 cumulative update NOT found."
    exit 1
}

Sources

1. CrowdStrike — September 2026 Patch Tuesday Analysis
2. Cisco Talos — September 2026 Patch Tuesday Snort Rules
3. Zero Day Initiative — September 2026 Security Update Review
4. Rapid7 — September 2026 Patch Tuesday
5. Qualys — September 2026 Patch Tuesday Security Update Review
6. Microsoft MSRC — CVE-2026-69845 Update Guide
7. Action1 — September 2026 CISO Executive Summary