CVE-2026-72979

Windows DHCP Server is the service that hands out network settings (like IP addresses) to devices on your network. This bug is like a mistake in how the server manages memory while processing DHCP traffic, which can let an attacker run code on the server from the network. In practical terms, if a malicious sender can reach your DHCP server, they may be able to take control or disrupt it.

This matters if you use the Windows DHCP Server role on Windows 10 or any of the listed Windows Server versions. It’s specifically a risk when the DHCP service can be reached from a network connection (for example, from client networks or other reachable segments). Only consider exposure if the vulnerable service is present and reachable; otherwise it won’t apply.

This is a RED issue because it’s a remote code execution vulnerability in a network-facing service, which can allow attackers to compromise servers without needing a user to click anything. Even though it’s not in CISA KEV and there’s no public exploit code on record, the traffic-light verdict is still RED due to the severity and network reachability of DHCP.

1. Inventory and exposure check (fast):

   • Find every machine running the DHCP Server role on the affected operating systems.
   • Confirm network reachability: check whether the DHCP server is reachable from any external or untrusted network segments, and whether DHCP requests can be sent to it.

2. Determine whether each system is vulnerable:

   • For each DHCP server, record the Windows version/build number.
   • If your build is earlier than the fixed build listed below for your OS family, you should treat the machine as vulnerable until patched.

3. Upgrade/patch targets (fixed versions):

   • Windows 10: fixed in 10.0.14393.9512 or 10.0.17763.9245
   • Windows Server 2012: fixed in 6.2.9200.26349
   • Windows Server 2012 R2: fixed in 6.3.9600.23397
   • Windows Server 2016: fixed in 10.0.14393.9512
   • Windows Server 2019: fixed in 10.0.17763.9245
   • Windows Server 2022: fixed in 10.0.20348.5622
   • Windows Server 2025: fixed in 10.0.26100.33438

4. Apply the vendor fix:

   • Install the Microsoft update for CVE-2026-72979 from the update guide page: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72979
   • Reboot if the update requires it.

5. Verification:

   • After reboot, re-check the Windows version/build number to confirm it matches (or is higher than) the fixed version for your OS.

6. Temporary workaround (if patching is delayed):

   • Reduce exposure by ensuring only trusted networks/segments can reach DHCP server ports.
   • If your environment allows it, limit DHCP service reachability to the specific client networks that require it.

7. What to monitor:

   • Monitor DHCP server availability and event logs for unusual DHCP processing errors after the change window.
   • Watch for unexpected network traffic patterns toward DHCP servers from unexpected subnets.

Severity is critical: this is a Windows DHCP Server remote code execution issue (CWE-416: use-after-free). The issue is reachable over the network because DHCP is a network-facing service and attackers can send crafted DHCP messages to trigger the memory-handling flaw, potentially resulting in code execution and full impact to confidentiality and integrity, with availability impact as well.

Findings summary relevant to real-world risk: the issue is not listed in CISA KEV, and there is no public exploit code on record. EPSS predicted likelihood is low and flat (prediction only; not a basis to relax response). Press attention indicates exploitation-related activity by Qualys, and the assigned traffic-light verdict for this CVE is RED.

Because it’s an unauthenticated network-facing service scenario (no login required as implied by the vulnerability type and reachability), exposure depends on whether the DHCP Server role is installed and reachable from an attacker-controlled network path.