Infrastructure Teams Urged to Patch Windows DHCP Server After Critical Use-After-Free Flaw Rated CVSS 9.8
A use-after-free vulnerability in Microsoft Windows DHCP Server allows network-based remote code execution, demanding immediate attention from infrastructure teams.
Key points
- CVE-2026-96934 is rated CVSS 9.8 Critical by the NVD.
- The flaw allows unauthorized attackers to run code over a network.
- The vulnerability stems from a use-after-free error in the DHCP service.
Microsoft Windows DHCP Server contains a critical security vulnerability that permits unauthorized remote code execution. The flaw, identified as CVE-2026-96934, stems from a use-after-free error within the server component. The National Vulnerability Database rates the issue at 9.8, the highest possible severity score. Attackers can exploit this weakness over a network.
How it unfolded
- A use-after-free condition was identified in the Windows DHCP Server handling routines.
- The flaw was cataloged as CVE-2026-96934 in the Common Vulnerabilities and Exposures database.
- The NVD assigned a CVSS score of 9.8, classifying the risk as Critical.
Who is affected
Organizations running Microsoft Windows DHCP Server are directly exposed to this threat. The vulnerability allows an attacker to execute arbitrary code on the affected system from a distance. Because the flaw exists in the server component, any Windows instance acting as a DHCP server is potentially compromised. The NVD record specifies the weakness as CWE-416, confirming the memory corruption nature of the bug.
Our take on the response
The high CVSS score reflects the severity of the remote code execution risk. Remote execution is a severe risk for internal networks. As Patch Observer noted in recent reports on similar critical flaws, such as those in Adobe ColdFusion and Dragonfly DB, vendors and users must act swiftly when remote execution is possible. The classification highlights the potential impact on affected systems.
Who needs to act first
Teams should prioritize inventorying all systems running Windows DHCP Server immediately. Identify which servers are exposed to untrusted network segments or the internet. Before applying any changes, ensure you have current backups of server configurations and data. Test updates in a non-production environment to verify stability before rolling out changes broadly. Monitor network logs for unusual DHCP activity that might indicate exploitation attempts while you work on remediation.
What to do and how to stay safe: Microsoft
- Audit your network to locate all instances of Windows DHCP Server.
- Restrict network access to DHCP servers to only authorized management interfaces.
- Monitor server logs for unexpected code execution or memory corruption errors.
- Prepare to apply vendor updates as soon as they are officially released.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-96934?
The NVD rates CVE-2026-96934 as 9.8, which is classified as Critical.
Can attackers exploit this flaw remotely?
Yes, the vulnerability allows an unauthorized attacker to execute code over a network.
Is there a patch available for this vulnerability?
The provided source material does not confirm the availability of a patch or update.
