Windows DHCP Server heap-based buffer overflow allows unauthorised remote code execution (CVE-2026-96320)

What happened

CVE-2026-96320 is a heap-based buffer overflow in the Windows DHCP Server. The CVE record describes an unauthorised attacker executing code over a network, and the CVSS 3.1 vector gives this a critical 9.8 score: network attack vector, low attack complexity, no privileges required and no user interaction. An attacker who can reach a vulnerable DHCP Server over the network can therefore attempt exploitation without authentication.

Microsoft has not reported exploitation or public disclosure, and the CVE record does not list the vulnerability as exploited. The SSVC assessment in the CVE record marks the flaw automatable with total technical impact. Successful execution has high impact on confidentiality, integrity and availability.

Who is affected

The vulnerable component is the Windows DHCP Server. Microsoft lists these affected products and build ranges:

Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612 Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376 Windows Server 2012 and 2012 R2, including Server Core installations: 6.2.9200.0 to before 6.2.9200.26434 and 6.3.9600.0 to before 6.3.9600.23470 Windows Server 2016, including Server Core installation: 10.0.14393.0 to before 10.0.14393.9612 Windows Server 2019, including Server Core installation: 10.0.17763.0 to before 10.0.17763.9376 Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761 Windows Server 2025, including Server Core installation: 10.0.26100.0 to before 10.0.26100.33650

What to do now

1. Apply the Microsoft security update for your branch. The fixed builds are:

• 6.2.9200.26434 — KB5126835 (Windows Server 2012)
• 6.3.9600.23470 — KB5126836 (Windows Server 2012 R2)
• 10.0.14393.9612 — KB5126868 (Windows 10 Version 1607 and Windows Server 2016)
• 10.0.17763.9376 — KB5126651 (Windows 10 Version 1809 and Windows Server 2019)
• 10.0.20348.5761 — KB5126655 (Windows Server 2022)
• 10.0.26100.33650 — KB5126646 (Windows Server 2025)

Find the update through the Microsoft Security Response Center advisory.

1. Microsoft has not published a workaround. If you cannot patch immediately, restrict access to the DHCP Server service to trusted client and management subnets, and monitor for unusual activity.

1. After installation, confirm the build number has moved to the fixed version for your product.

How to detect it

Microsoft has not published indicators of compromise for this CVE. Start with an inventory of systems running the DHCP Server role and confirm whether any are reachable from untrusted or guest network segments; the attack vector is network-based and requires no credentials. Because exploitation is code execution, EDR and SIEM should monitor for unusual processes, network connections or service behaviour associated with the DHCP Server process.

Beyond the patch

This is a remotely reachable service that needs no credentials, so the first question is where it is exposed. Virtual CISO Services (vCISO) helps identify and reduce that exposure before the next advisory lands. After patching, Managed Detection & Response (MDR) provides the EDR and SIEM coverage to detect code execution that otherwise looks like routine administration. Both make the next critical update less of an emergency.