Microsoft disclosed a CVSS 9.8 use-after-free flaw in the Windows DHCP Server service that lets an unauthorized attacker execute code over a network with no privileges and no user interaction.
What Is It
CVE-2026-72979 is a use-after-free vulnerability (CWE-416) in Windows DHCP Server. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." The CVE was published on 2026-09-08 by Microsoft ([email protected]) and currently carries an NVD status of "Awaiting Analysis."
Microsoft assigned a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Why It Matters
Every exploitability factor in the vector is at its worst setting: network attack vector, low attack complexity, no privileges required, and no user interaction. The impact side is equally bad, high confidentiality, integrity, and availability impact, yielding an exploitability subscore of 3.9 and an impact subscore of 5.9.
DHCP Server is a core infrastructure role, so a successful exploit lands code execution on a server that much of the network depends on. As of publication, CVE-2026-72979 does not appear in CISA's Known Exploited Vulnerabilities catalog, so there is no confirmed evidence of active exploitation at this time and no KEV-mandated remediation deadline.
What's Vulnerable
Microsoft lists the following affected products and fixed build thresholds:
| Product | Affected below build |
|---|---|
| Windows 10 Version 1607 (32-bit, x64) | 10.0.14393.9512 |
| Windows 10 Version 1809 (32-bit, x64) | 10.0.17763.9245 |
| Windows Server 2012 (incl. Server Core) | 6.2.9200.26349 |
| Windows Server 2012 R2 (incl. Server Core) | 6.3.9600.23397 |
| Windows Server 2016 (incl. Server Core) | 10.0.14393.9512 |
| Windows Server 2019 (incl. Server Core) | 10.0.17763.9245 |
| Windows Server 2022 | 10.0.20348.5622 |
| Windows Server 2025 (incl. Server Core) | 10.0.26100.33438 |
All server entries are x64-based systems. The range spans Server 2012 through Server 2025; roughly the entire supported Windows Server lineage.
Patch Status
Microsoft has published the advisory in the MSRC Update Guide, and the fixed build numbers above indicate updates are available. Administrators should patch DHCP Server hosts to at or above the listed build for their OS version. Microsoft's advisory does not list any workarounds or mitigations, so installing the update is the only remediation path Microsoft offers.
Sources
- Microsoft MSRC Update Guide; CVE-2026-72979: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72979
- NVD CVE Record; CVE-2026-72979: https://nvd.nist.gov/vuln/detail/CVE-2026-72979
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog