CVE-2026-54128

Windows DHCP Client Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 27th percentile. A vendor fix is available.

CVSS 3.18.4High EPSS percentile27th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Identify which machines you run from this list (Windows 10, Windows 11, Windows Server 2012/2012 R2/2016/2019/2022/2025) and collect their exact OS version/build.
Check whether your DHCP Client service is in use on those machines (typical on systems that use network-assigned IP settings).
Apply the vendor fix by upgrading each affected OS to at least the fixed version shown below in the “Windows → fixed in …” list.
Reboot as required by the update and verify the update installed successfully.
If you cannot patch immediately, restrict who can access the affected systems from the network (and reduce local access paths) until updates are applied.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

CVE-2026-54128 is a Windows DHCP Client bug that can let an attacker run malicious code on the affected computer—this is serious and you should patch, especially on servers or systems that may be reachable by others.

CVE-2026-54128 is a use-after-free vulnerability in the Windows DHCP Client that can be exploited by an unauthorized local attacker to execute arbitrary code in the context of the DHCP client; no authentication or user interaction is required.

If you're affected

Full server or workstation takeover
Malicious code execution on network host
Network service disruption
Credential theft risk

What is it

This flaw is like a “memory mistake” in Windows’ DHCP Client, which is responsible for getting network settings (like an IP address). An attacker who can reach the machine in the local sense can trick Windows into using freed memory, which can let them run their own code. For a business, that’s the difference between a normal computer and one an attacker can fully control.

Who is affected

This affects Windows 10, Windows 11, and multiple Windows Server versions (2012, 2012 R2, 2016, 2019, 2022, 2025) that include the Windows DHCP Client component. It matters to you if your business uses these operating systems on devices that other people or systems can access locally (for example, network-segmented environments, shared admin access paths, or devices that are reachable by attackers on the same infrastructure). The risk is especially relevant when an attacker can get a foothold that makes “local exploitation” possible, since authentication and user interaction are not required by the vulnerability.

How urgent is it

This is RED because attackers can execute arbitrary code on the target machine using the DHCP client’s privileges, which can quickly lead to full compromise. Even though a public exploit isn’t confirmed in the findings, the fix is available and the impact is high, so waiting increases your exposure window.

What to do — in detail

Confirm exposure

For each affected machine, determine the exact Windows version/build number.
Confirm whether the machine is using the Windows DHCP Client in normal operation (typical for computers/servers that obtain IP/network settings automatically rather than being fully static-configured).

Upgrade to fixed versions

Patch to at least the fixed build for your OS branch:

Windows 10 → fixed in 10.0.14393.9339
Windows 10 → fixed in 10.0.17763.9020
Windows 10 → fixed in 10.0.19044.7548
Windows 10 → fixed in 10.0.19045.7548
Windows 11 → fixed in 10.0.26100.8875
Windows 11 → fixed in 10.0.26200.8875
Windows 11 → fixed in 10.0.28000.2269
Windows Server 2012 → fixed in 6.2.9200.26226
Windows Server 2012 R2 → fixed in 6.3.9600.23291
Windows Server 2016 → fixed in 10.0.14393.9339
Windows Server 2019 → fixed in 10.0.17763.9020
Windows Server 2022 → fixed in 10.0.20348.5386

Verify

After installation, reboot if required.
Re-check the OS build number to confirm it is at or above the fixed version for that branch.

If patching is delayed (temporary containment)

Reduce the chance of an attacker getting the “local” access needed to trigger exploitation by tightening access controls (who can log on locally, who can administer systems, and what network paths are reachable).
Prioritize patching for systems that are servers or are more exposed to other devices/users on your network.

What to monitor

Look for unusual local activity around networking/DHCP-related behavior (unexpected service restarts, suspicious processes spawned around network changes) and review security logs for abnormal authentication/access patterns.

Technical context

Severity: High (CVSS 8.4). Weakness type: CWE-416 (use-after-free). Mechanism: the Windows DHCP Client contains a use-after-free flaw that an unauthorized attacker can use to run arbitrary code locally; the findings indicate no authentication and no user interaction are required. Exploitation status: not listed in CISA KEV and no public exploit code was found in the provided findings; however, press coverage notes it as a critical DHCP Client RCE issue (no clear dated exploitation claim is included in the findings). Fix availability: fixed versions are provided for multiple Windows 10/11 and Windows Server branches; prioritize updating to the specified fixed builds. What KEV means here: since it is not listed, it is not confirmed via CISA KEV in the provided data.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS27th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 27th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 27 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-21Patch availablerecord updated
2026-07-15Record updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated
2026-06-25OpenVAS check added

Affected products

Microsoftcommercial · US

And 22 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.4 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable