CVE-2026-50370

DHCP Server Service Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 40th percentile. A vendor fix is available.

CVSS 3.18.8High EPSS percentile40th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-20Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run the Windows DHCP Server role/service on any of these systems: Windows 10, Windows Server 2012/2012 R2, 2016, 2019, 2022, or 2025.
If DHCP Server is in use on affected versions, update immediately to the fixed versions listed by Microsoft for CVE-2026-50370.
Verify updates completed and reboot if your organization’s update policy requires it.
If you can’t patch right away, restrict network access to the DHCP Server so only the intended subnets/clients can reach it, and document the temporary risk acceptance until patching is complete.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

In plain language

Written by AI from the record

CVE-2026-50370 is a Windows DHCP Server security flaw that can let a remote attacker run code from the network; if your small business runs DHCP Server on affected Windows versions, you should treat this as urgent and patch now.

CVE-2026-50370 is a Windows DHCP Server Remote Code Execution issue caused by a memory-safety weakness (heap buffer overflow) that can be triggered by an attacker from an adjacent network segment against the DHCP Server service.

If you're affected

Full device compromise
Network-wide disruption
Malware installation risk
Service outage

What is it

Windows’ DHCP Server hands out IP addresses to devices on your network. This flaw could let someone who can reach the DHCP Server from the network run malicious code on the server itself—like taking control of the “traffic controller” that all devices depend on.

Who is affected

This matters to you if you run the Windows DHCP Server service on Windows 10 or the listed Windows Server versions. The risk applies when an attacker can reach the DHCP Server service from the network (i.e., it’s network-reachable from an adjacent segment), not just from being logged into the machine—there’s no known need for a user to click anything.

How urgent is it

This is a RED issue because it’s a remote code execution risk in a critical network service (DHCP Server). Even though the findings don’t show a confirmed public exploit release or KEV entry, the impact is severe enough that patching should be treated as immediate.

What to do — in detail

Confirm exposure (quick inventory)
- Identify all machines running the DHCP Server role/service.
- For each, note the OS version/build to compare against the fixed versions below.
Target the fixed versions from Microsoft
- Windows 10 → fixed in 10.0.14393.9339 or 10.0.17763.9020
- Windows Server 2012 → fixed in 6.2.9200.26226
- Windows Server 2012 R2 → fixed in 6.3.9600.23291
- Windows Server 2016 → fixed in 10.0.14393.9339
- Windows Server 2019 → fixed in 10.0.17763.9020
- Windows Server 2022 → fixed in 10.0.20348.5386
- Windows Server 2025 → fixed in 10.0.26100.33158
Apply the patch
- Install the Microsoft security update for CVE-2026-50370 (see Microsoft Update Guide link in the patch finding).
- Reboot if your environment requires it and after installation to ensure the DHCP Server service runs the patched components.
Temporary mitigation if patching is delayed
- Limit who can reach the DHCP Server service using network controls (firewall rules / VLAN segmentation) so only the intended DHCP client networks can contact it.
- Do not expose DHCP Server broadly; remove unnecessary routing paths that would allow “adjacent network” reachability.
After patching (verification)
- Confirm DHCP Server continues to issue addresses normally.
- Review DHCP server and system logs for unusual network traffic or errors around DHCP request handling.
What to monitor next
- Microsoft security guidance for CVE-2026-50370 updates.
- Any new reporting of active exploitation; none was clearly dated in the provided findings, so treat ongoing monitoring as “watch for confirmation” rather than “assume it’s being exploited.”

Technical context

CVE-2026-50370 is classified as a memory-safety bug (CWE-20, CWE-122) in the Windows DHCP Server service. The underlying issue is described as a heap-based buffer overflow that could allow remote code execution when an attacker can trigger the condition by sending crafted input over the network to DHCP Server.

Findings summary for exploitation status: no entry in the CISA KEV list, no clearly dated real-world press claim, and no public exploit code on record. Predictive EPSS exists but is not used as a decision driver here; the traffic-light verdict is RED because the capability is remote code execution against a commonly deployed network service.

Attack vector (from the provided assessment): network-based (adjacent network reachability), with no user interaction required. The likely practical risk hinges on whether the DHCP Server is reachable by an attacker from the network segment(s) they can access.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS40th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 40th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 6 days, from the signal feeds we watch.

2026-07-20Patch availablerecord updated
2026-07-16OpenVAS check added
2026-07-15Record updatedrecord updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 13 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector AdjacentRequires access to the local network (e.g. same Wi-Fi, Bluetooth)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable