Microsoft has disclosed a heap-based buffer overflow in Windows DHCP Server, tracked as CVE-2026-69845, that allows an unauthorized attacker to execute code over a network with a CVSS 3.1 base score of 9.8.
What Is It
CVE-2026-69845 is a heap-based buffer overflow in the Windows DHCP Server service. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." Microsoft assigns the issue two weakness classes: CWE-20 (improper input validation) and CWE-122 (heap-based buffer overflow), indicating the overflow stems from insufficient validation of attacker-supplied input reaching the DHCP service.
The CVE was published on 2026-09-08 with a vulnerability status of "Awaiting Analysis," meaning NVD has not yet completed its own enrichment of the record.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8, CRITICAL. Every exploitability dimension is at its worst case: network attack vector, low attack complexity, no privileges required, and no user interaction. The exploitability subscore is the maximum 3.9, with an impact subscore of 5.9 reflecting high impact across confidentiality, integrity, and availability.
DHCP Server is a role commonly deployed on domain infrastructure, so remote unauthenticated code execution in that service carries obvious consequence for the network it serves.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the source material.
What's Vulnerable
Microsoft lists the following affected products, each vulnerable below the noted build:
- Windows 10 Version 1607 (32-bit, x64), before 10.0.14393.9512
- Windows 10 Version 1809 (32-bit, x64), before 10.0.17763.9245
- Windows Server 2012 and Server Core (x64), before 6.2.9200.26349
- Windows Server 2012 R2 and Server Core (x64), before 6.3.9600.23397
- Windows Server 2016 and Server Core (x64), before 10.0.14393.9512
- Windows Server 2019 and Server Core (x64), before 10.0.17763.9245
- Windows Server 2022 (x64), before 10.0.20348.5622
- Windows Server 2025 and Server Core (x64), before 10.0.26100.33438
Patch Status
Fixed builds exist for all listed products, as reflected in the version ranges above. Administrators should apply the Microsoft updates that bring affected systems to at or above the fixed build for their platform; consult the MSRC Update Guide entry for the specific update packages. No CISA-mandated remediation deadline was present in the supplied source material.
Sources
- Microsoft Security Response Center; Update Guide, CVE-2026-69845: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69845
- NVD, CVE-2026-69845: https://nvd.nist.gov/vuln/detail/CVE-2026-69845