External risk intelligence

Windows DHCP Server Use After Free Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-96934

Windows DHCP Server is a core infrastructure service typically deployed within internal network segments to manage local IP addressing. While it is network-reachable, it is designed to operate on local subnets and is rarely exposed directly to the public internet in standard deployment configurations.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Windows DHCP Server that could allow an attacker to execute code remotely over a network. This type of flaw is significant because it affects a core network service responsible for assigning IP addresses, potentially impacting a wide range of systems. While the direct exposure of this service to external threats may be limited in typical configurations, the severity of the vulnerability warrants careful assessment of its relevance within our environment.

Flaw lets attackers run code remotely.
Critical flaw in core network service.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach an affected Windows DHCP Server over a network without any special privileges or user interaction. Once network access is established, the attacker can trigger a use-after-free vulnerability. This vulnerability could allow an attacker to execute arbitrary code with elevated privileges.

Network access required.
Use-after-free vulnerability triggered.
Arbitrary code execution risk.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Windows DHCP Server could permit an unauthenticated attacker to execute arbitrary code over the network. This could occur when the DHCP server is configured to allow unauthorized network access.

Code execution on DHCP server.
Network exploitation when supported.
System compromise and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given this vulnerability impacts Windows DHCP Server, ownership likely falls to infrastructure or platform teams responsible for core networking services, with potential coordination needed from security teams to assess exposure. The immediate first step is to identify all DHCP server instances, confirm their network reachability and business criticality, and then assign an accountable owner for remediation planning.

Infrastructure or platform teams own the issue.
Verify DHCP server network reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows DHCP Server and why is it important?

Windows DHCP Server is a foundational component of the Windows Server operating system. It automates the process of assigning IP addresses and network configuration settings to devices joining a network, ensuring they can communicate with other systems. Because it serves as a central hub for managing connectivity, it is a critical piece of infrastructure that supports the functionality of almost all other systems on a network.

What does use-after-free mean in CVE-2026-96934?

This vulnerability is a 'use-after-free' (CWE-416) memory error. It occurs when the software continues to use a pointer to a memory location after that memory has been cleared or released. If an attacker can manipulate this process, they may be able to trick the server into executing unauthorized code in that memory space instead of performing its intended network tasks.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specifically crafted network requests to the DHCP service. No prior user interaction or special authentication is required for the code execution to initiate. Crucially, the vulnerability does not trigger through normal, valid DHCP operations; it requires the processing of malicious inputs designed to exploit the memory handling error.

Is my Windows DHCP Server at high risk?

Halo Surface Signal notes that while this service is network-reachable, it is typically deployed within internal network segments and is rarely exposed directly to the public internet. If your DHCP server is behind standard network perimeters and not accessible from outside your organization, your immediate risk profile is significantly lower than a system directly connected to the internet.

How should I respond to this threat?

Your first step is to create a complete inventory of all systems running the Windows DHCP Server role. Once identified, verify their network placement to confirm whether they are accessible from untrusted networks. Engage your infrastructure or networking teams to track the availability of official updates and prepare to apply them as part of your standard maintenance lifecycle.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96934

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.