CVE-2026-56159

DHCP Server is the Windows service that hands out network settings (like IP addresses) to devices. This vulnerability is like a “crash and takeover” flaw in that service: if it’s reachable, a bad actor could send specially crafted network traffic that causes the service to run attacker-controlled code. In a small business, that can mean the attacker gains control of your network infrastructure, not just one workstation.

This matters if your organization runs the Windows DHCP Server service on any of these systems: Windows 10 and Windows Server 2012, 2012 R2, 2016, 2019, 2022, or 2025. If you only use DHCP as a client (your devices request addresses) but do not run a DHCP server, this is generally not your exposure.

Reachability matters: the risk is tied to whether an attacker can reach the DHCP Server service over the network (no login is required per the reported weakness).

This is marked RED because it’s a critical remote code execution issue in a network-facing core service (DHCP Server). Even without confirmed public exploit details in the provided sources, the impact is severe: a remote attacker could gain control of the DHCP server over the network.

Confirm exposure

1. Identify the affected systems: Windows 10 and Windows Server 2012/2012 R2/2016/2019/2022/2025.
2. On each system, confirm whether the DHCP Server service/role is actually installed and running (this CVE targets the DHCP Server service, not DHCP client).
3. Record the current Windows build/patch level so you can compare it to the fixed versions below.

Apply the fix (fixed versions)

Patch to the fixed build that matches your OS branch:

• Windows 10:
  • fixed in 10.0.14393.9339, and/or
  • fixed in 10.0.17763.9020
• Windows Server 2012: fixed in 6.2.9200.26226
• Windows Server 2012 R2: fixed in 6.3.9600.23291
• Windows Server 2016: fixed in 10.0.14393.9339
• Windows Server 2019: fixed in 10.0.17763.9020
• Windows Server 2022: fixed in 10.0.20348.5386
• Windows Server 2025: fixed in 10.0.26100.33158

Use the Microsoft security update guidance for CVE-2026-56159: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56159

If patching is delayed (temporary containment)

• Limit network reachability to the DHCP Server service so untrusted networks can’t contact it.
• If feasible for your environment, stop/disabling the DHCP Server role during the window when you are not patched (ensure you have an alternate way to provide addressing, or plan a maintenance change).

What to monitor

• DHCP server availability and event logs immediately after patching.
• Network traffic patterns to the DHCP server during the window before updates (look for unusual or repeated attempts coming from unexpected sources).

KEV / exploitation notes from provided sources

• This CVE is not listed in the CISA KEV in the provided findings.
• No public exploit code is recorded in the provided findings.
• The provided sources do not state confirmed exploitation incidents with clear dates.

CVE-2026-56159 is a heap-based buffer overflow (CWE-122) in the Windows DHCP Server service. The weakness is reachable remotely and does not require authentication (reported as PR:N and UI:N in the provided details), meaning an attacker can potentially trigger the flaw by sending crafted network traffic to the DHCP server.

Exploitation status per provided findings: no public exploit code on record and no confirmed, clearly dated exploitation claims in the provided press/news. KEV (CISA Known Exploited Vulnerabilities) listing is not present in the provided findings.

Fix availability per provided findings: Microsoft has fixed builds for each affected OS branch (Windows 10; Windows Server 2012/2012 R2/2016/2019/2022/2025). Given the service is network-facing and the impact is full remote code execution, the operational risk is treated as RED.

EPSS: a prediction is provided in the findings (trend flat), but exploitation/KEV would override prediction; the provided findings do not include KEV listing or public exploit code.