CVE-2026-48564

Windows DHCP Server hands out network settings (like IP addresses) to devices. This bug can let a hostile party trigger a memory-handling flaw through network traffic and cause the server to run malicious code. If it succeeds, the attacker may take over the machine and disrupt the network that your business relies on.

This matters if you use the Windows DHCP Server role on windows 10, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2025, or windows server 2012 r2. A remote attacker only needs network access to target the DHCP Server service, so any reachable DHCP Server in your environment is in scope once it’s exposed. Only proceed if the DHCP Server role is actually in use on those systems (it’s not a general “every Windows device” issue).

This is urgent (RED) because it’s a remote code execution issue in a network-facing service, meaning an attacker can potentially gain control of the server from the network. Even though KEV is not listed and no public exploit code is on record, Microsoft has already released fixes for multiple affected Windows versions, and press attention is focused on patching. Prioritize installing the vendor updates immediately on any server running DHCP Server.

1. Confirm exposure (what to check)

   • Identify which machines are running the DHCP Server role on the affected Windows versions.
   • Check whether the DHCP service is enabled and listening (for example, whether you rely on it for IP assignment).

2. Confirm current patch level

   • On each DHCP Server host, determine its current Windows version/build number.
   • Compare against the fixed versions below.

3. Upgrade to the fixed version (per OS)

   • windows 10: fixed in 10.0.14393.9339 OR 10.0.17763.9020.
   • windows server 2012: fixed in 6.2.9200.26132.
   • windows server 2012 r2: fixed in 6.3.9600.23228.
   • windows server 2016: fixed in 10.0.14393.9339.
   • windows server 2019: fixed in 10.0.17763.9020.
   • windows server 2022: fixed in 10.0.20348.5386.
   • windows server 2025: fixed in 10.0.26100.33158.

4. Where to get the update

   • Use Microsoft’s official Update Guide entry for CVE-2026-48564: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48564

5. If patching must be delayed (temporary containment)

   • Reduce exposure by limiting network reachability to DHCP Server (e.g., restrict who can communicate with the DHCP service at the network boundary).
   • If your environment allows it, avoid leaving DHCP Server reachable from untrusted networks.

6. Verify after installation

   • Re-check the build/version on each host to ensure it matches a fixed version listed above.
   • Confirm the DHCP Server service still operates normally (no scope failures or unexpected outages).

7. What to monitor

   • Watch for unusual network activity targeting the DHCP service and unexpected service restarts after patching.
   • If you have centralized logging, look for repeated DHCP-related errors around the time of any suspicious traffic.

Severity: HIGH (CVSS 8.8). Weakness: CWE-122. Type: heap-based buffer overflow in the Windows DHCP Server. Trigger/attack vector: a remote attacker can send crafted network traffic to the DHCP Server service to corrupt memory and achieve remote code execution; the public findings describe it as “Remote Code Execution” with the affected component being DHCP Server. Exploitation status: no entry in CISA KEV and no public exploit code is on record; press reports do not provide a clear dated claim of exploitation. Patch availability: fixes exist for the specified Windows versions/builds (as listed in the findings). EPSS: 0.8% with a flat trend, but this is a prediction only and is not used to reduce urgency when vendor fixes are available. KEV meaning here: since it is not in the KEV list, there is not a confirmed CISA “known exploited” designation in the provided findings.