Windows DHCP Server use-after-free allows unauthenticated remote code execution (CVE-2026-96934)

What happened

CVE-2026-96934 is a use-after-free in the Windows DHCP Server. Microsoft describes it as allowing an unauthorized attacker to execute code over a network. The CVSS 3.1 vector has a network attack vector, low attack complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability; the base score is 9.8 and Microsoft rates the vulnerability Critical.

Exploitation has not been confirmed; Microsoft has not said it has been exploited and no public disclosure is recorded. The vulnerability is assessed as automatable, with total technical impact, so unpatched DHCP servers should be treated as high-priority patch targets.

Who is affected

Microsoft lists Windows 10 Version 1607 and 1809, Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Affected builds are:

Windows 10 1607 10.0.14393.0 to before 10.0.14393.9612; Windows 10 1809 10.0.17763.0 to before 10.0.17763.9376; Windows Server 2012 6.2.9200.0 to before 6.2.9200.26434; Windows Server 2012 R2 6.3.9600.0 to before 6.3.9600.23470; Windows Server 2016 10.0.14393.0 to before 10.0.14393.9612; Windows Server 2019 10.0.17763.0 to before 10.0.17763.9376; Windows Server 2022 10.0.20348.0 to before 10.0.20348.5761; Windows Server 2025 10.0.26100.0 to before 10.0.26100.33650.

Server Core installations follow the same build numbers as their full installations.

What to do now

1. Apply the October 2026 security update. The fixed versions are Windows 10 Version 1607 and Windows Server 2016 10.0.14393.9612 (KB5126868); Windows 10 Version 1809 and Windows Server 2019 10.0.17763.9376 (KB5126651); Windows Server 2012 6.2.9200.26434 (KB5126835); Windows Server 2012 R2 6.3.9600.23470 (KB5126836); Windows Server 2022 10.0.20348.5761 (KB5126655); Windows Server 2025 10.0.26100.33650 (KB5126646). Server Core installations use the same builds and KBs.

1. Prioritise DHCP servers reachable from untrusted segments; the attack requires network access but no credentials or user interaction.

1. Microsoft's advisory does not list workarounds or mitigations. If you cannot patch immediately, restrict DHCP service exposure to trusted network segments.

Beyond the patch

This is the kind of network-reachable, unauthenticated remote code execution flaw that often lives on infrastructure servers outside routine patch schedules. Virtual CISO Services can help you inventory and reduce this class of exposed service, while Managed Detection & Response watches for post-exploitation activity on servers that could not be patched before exposure. Apply the update first, then make sure every DHCP server is visible and monitored.