CVE-2026-69620: Windows DHCP Server Remote Code Execution Vulnerability

Microsoft Security Response Center classifies CVE-2026-69620: Windows DHCP Server Remote Code Execution Vulnerability as Important. Its advisory describes a stack-based buffer overflow in Windows DHCP Server that allows an unauthorized attacker to execute code over a network.

CVE-2026-69620 targets Windows DHCP Server through the network​

DHCP, or Dynamic Host Configuration Protocol, is the network service responsible for assigning IP addresses and related network settings to clients. A weakness in a DHCP server is operationally significant because it sits at a central network-control point: clients rely on it to join and communicate on the network.

Microsoft identifies the underlying weakness as CWE-121, a stack-based buffer overflow. The advisory states that successful exploitation could allow remote code execution through an in-network attacker calling arbitrary endpoints. The stated attack condition is important: the attacker is described as in-network, not as someone reaching an exposed service from any location on the internet.

The vulnerability’s CVSS base score is 8.1, with a temporal score of 7.1. Microsoft lists the complete CVSS vector as:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The vector records network attackability and no required privileges or user interaction, while also assigning High impact to confidentiality, integrity, and availability if the flaw is successfully exploited. Its High attack-complexity rating aligns with Microsoft’s exploitation assessment, but it should not be treated as a reason to defer a server update.

Microsoft’s current status fields are:

• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Microsoft’s exploitation assessment is Exploitation Unlikely.

Microsoft’s DHCP Server advisory makes patching the required response​

The meaningful boundary for CVE-2026-69620 is whether a listed Windows installation is operating Windows DHCP Server. The advisory concerns the server component, so patch teams should begin with DHCP-role inventory rather than treating every Windows endpoint at the same urgency.

The affected list includes older Windows 10 versions and Windows Server generations from Windows Server 2012 through Windows Server 2025. It also explicitly includes Server Core installations where specified. Server Core systems are particularly easy to miss in a visual desktop-oriented inventory, even though they can host core network infrastructure roles.

Microsoft provides a fixed build for each affected product and maps it to a specific KB. The appropriate remediation is to install the KB for the exact operating system version and architecture, then confirm that the machine has reached the corresponding build.

KB5123099, KB5122876, KB5122882, KB5123065, and KB5123066 map to fixed builds​

The following Microsoft remediation mapping covers every affected product listed for CVE-2026-69620.

The repeated KB mappings are deliberate. KB5123099 covers the listed Windows 10 Version 1607 and Windows Server 2016 products; KB5122876 covers the listed Windows 10 Version 1809 and Windows Server 2019 products. Deployment tooling should still use the operating system’s exact product identity, architecture, and servicing configuration when selecting an update.

CVE-2026-69620 requires DHCP-role inventory before deployment​

Administrators should treat this as a network-services patching task, not solely as a generic workstation update. The immediate goal is to locate Windows systems that supply DHCP, establish which listed version each system runs, and match it to Microsoft’s fixed-build target.

A sensible deployment sequence is:

1. Identify Windows DHCP Server instances, including Windows Server Core installations and any legacy DHCP deployments maintained for isolated networks, laboratories, branches, or compatibility purposes.
2. Record each server’s exact Windows product version and architecture before assigning the KB.
3. Deploy the mapped update through the organization’s normal servicing process and account for the operational maintenance window appropriate to a DHCP service.
4. Confirm the device reaches Microsoft’s stated fixed build rather than relying only on an update job’s completion state.
5. Keep the deployment record tied to CVE-2026-69620 so that exception tracking distinguishes an unpatched DHCP server from a device that is outside the affected product list.

The advisory’s distinction between an in-network attacker and an external attacker should inform prioritization, particularly for DHCP servers on networks with many unmanaged, guest, branch, or otherwise less-trusted clients. It does not change Microsoft’s stated requirement for customer action.

What this means for you​

Patch listed Windows systems that run DHCP Server first, verify the fixed build after installation, and use the published mappings to avoid deploying an update intended for a different servicing branch.

• Microsoft rates CVE-2026-69620 as Important with a CVSS base score of 8.1 and a temporal score of 7.1.
• The flaw is a CWE-121 stack-based buffer overflow in Windows DHCP Server that can permit remote code execution over a network.
• Microsoft describes the exploitation path as an in-network attacker calling arbitrary endpoints and assesses exploitation as Exploitation Unlikely.
• Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 are represented in the affected product list, including specified Server Core installations.
• Windows 10 Version 1607 and Windows 10 Version 1809 are also listed in both 32-bit and x64 variants, with KB5123099 or KB5122876 depending on version.
• Customer action required: Yes, so update validation should include the exact fixed-build target Microsoft assigns to the operating system.

CVE-2026-69620 is a clear case for disciplined infrastructure patching: the exposure belongs to a central Windows network service, Microsoft has supplied concrete KB-to-build remediation targets, and the affected estate spans several long-lived server releases. For organizations that still operate DHCP on these versions, reaching the specified build is the actionable milestone.