CVE-2026-50518

Windows DHCP Server Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 60th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile60th1.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether this device runs the DHCP Server role (and whether DHCP server traffic can reach it).
Confirm the exact Windows version/build number on the server (Windows 10 or one of the listed Windows Server versions).
Upgrade/patch to the fixed build for your specific branch: Windows 10 10.0.14393.9339 or 10.0.17763.9020; Windows Server 2012 6.2.9200.26226; Windows Server 2012 R2 6.3.9600.23291; Windows Server 2016 10.0.14393.9339; Windows Server 2019 10.0.17763.9020; Windows Server 2022 10.0.20348.5386; Windows Server 2025 10.0.26100.33158.
If patching must be delayed, restrict network access so untrusted clients/networks cannot reach the DHCP Server service (allow only your approved admin networks and subnets).

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

This is a Windows DHCP Server flaw that can let an attacker run malicious code remotely without logins or user clicks; if you run DHCP Server on the affected Windows versions, you should treat it as urgent and patch.

CVE-2026-50518 is an unauthenticated, network-reachable heap-based buffer overflow in the Windows DHCP Server that can allow remote arbitrary code execution (CWE-122) with no user interaction required.

If you're affected

Full server compromise
Network-wide disruption
Credential theft risk
Ransomware enablement

What is it

DHCP Server is the part of Windows that hands out IP addresses to devices on your network. This bug is like a crash-and-takeover weakness: a remote attacker can send specially crafted network traffic and potentially make the DHCP service run attacker code. If that happens, they may be able to take over the server and disrupt or spy on your network.

Who is affected

This matters if you run Windows DHCP Server on any of these affected systems: Windows 10 or Windows Server 2012, 2012 R2, 2016, 2019, 2022, or 2025. The risk is higher when the DHCP Server service is reachable over the network because the flaw does not require authentication or user interaction. Treat it as a real concern when an attacker can reach the DHCP Server from outside your trusted admin networks; whether “default config” exposes it is not known from the provided findings.

How urgent is it

This is RED because attackers can remotely execute arbitrary code against the Windows DHCP Server without needing logins or user clicks. Even without confirmed public exploit details in the reporting you provided, the bug type and remote, unauthenticated reach make it something attackers can target quickly. Patch on an urgent timeline for any DHCP Server systems that match the affected versions.

What to do — in detail

Inventory and exposure check
- Identify every machine running the DHCP Server role on the affected Windows families.
- Confirm where DHCP traffic can come from (which subnets/VLANs, and whether any untrusted networks could reach UDP DHCP-related traffic). The provided findings do not confirm whether it is reachable in default configuration, so treat “network-reachable” as your key risk gate.
Determine whether you’re on an affected build
- For each DHCP Server host, record the exact Windows version/build.
- Compare to the fixed builds below; if you are at or below the affected builds (i.e., not yet on one of the fixed versions), you’re exposed.
Apply the fixed update for your branch
- Windows 10: fixed in 10.0.14393.9339 or 10.0.17763.9020
- Windows Server 2012: fixed in 6.2.9200.26226
- Windows Server 2012 R2: fixed in 6.3.9600.23291
- Windows Server 2016: fixed in 10.0.14393.9339
- Windows Server 2019: fixed in 10.0.17763.9020
- Windows Server 2022: fixed in 10.0.20348.5386
- Windows Server 2025: fixed in 10.0.26100.33158
Validation after patch
- Re-check the OS build number after updates complete.
- Ensure the DHCP Server service still starts normally and that expected leases continue to work.
Temporary workaround if patching is delayed
- Restrict network reachability to the DHCP Server so only approved networks/clients can access it.
- If you have a firewall or ACL in front of DHCP, tighten rules to block untrusted sources.
What to monitor
- DHCP Server availability and unexpected DHCP behavior (sudden lease changes, unusual client activity).
- Server logs for signs of crashes/restarts or abnormal network requests to the DHCP service during the patch window and shortly after.

CISA due date: Not provided in the findings (and this issue is not listed in the CISA KEV set you provided).

Technical context

CVE-2026-50518 is a heap-based buffer overflow (CWE-122) in the Windows DHCP Server that can result in remote arbitrary code execution. The findings specify exploitation conditions as: network attack vector, no authentication required, and no user interaction required.

Exploit/availability signals from provided findings:

KEV: not listed in CISA KEV.
Public exploit code: no public exploit code on record.
Press reporting: no clear dated real-world exploitation claim was provided.

Patch availability:

Microsoft fixed versions are provided for each affected Windows branch (Windows 10 and multiple Windows Server releases). The advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518.

Because this is remote and unauthenticated with very high impact potential (arbitrary code execution, full confidentiality/integrity/availability impact indicated by the provided severity scoring context), the operational priority for any exposed DHCP Server host is extremely high, even though confirmed exploitation details were not included in the findings you provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS60th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.0% chance of exploitation activity in the next 30 days, which ranks it in the 60th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

16 events over 41 days, from the signal feeds we watch.

2026-08-24EPSS band changemoderate → lowepss band change
2026-08-03EPSS band changelow → moderateanalysis published
2026-07-24EPSS band change0 → moderateepss band change
2026-07-22Patch availablerecord updated
2026-07-17Analysis publishedMicrosoft's biggest Patch Tuesday ever: what I'd actually fix first
2026-07-16OpenVAS check added

Affected products

Microsoftcommercial · US

And 13 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable