CVE-2026-69803: Windows DHCP Server Information Disclosure Vulnerability

Microsoft’s advisory, titled Windows DHCP Server Information Disclosure Vulnerability, identifies an out-of-bounds read in Windows DHCP Server. The flaw carries a CVSS base score of 5.9 and affects a wide spread of supported server generations, including Server Core installations, alongside older Windows 10 versions.

This is a patching and inventory task rather than a configuration workaround. Microsoft’s remediation record is explicit: Customer action required: Yes.

CVE-2026-69803 is a network-accessible Windows DHCP Server memory-disclosure flaw​

CVE-2026-69803 is classified as Important and maps to CWE-125, the Common Weakness Enumeration category for an out-of-bounds read. Microsoft describes the issue as follows: “Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.”

An out-of-bounds read occurs when software reads beyond the intended boundaries of a memory region. In this case, Microsoft’s advisory describes the impact as information disclosure, not modification of data or denial of service. The CVSS vector reflects that scope:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

The vector records network attack access, high attack complexity, no privileges required, and no user interaction. It assigns high confidentiality impact, with no integrity or availability impact. Microsoft lists a CVSS base score of 5.9 and a temporal score of 5.2.

Microsoft’s official advisory facts also state: “FAQ-Information Disclosure-iSNS: What type of information could be disclosed by this vulnerability? An attacker who successfully exploited this vulnerability could view heap memory from a privileged process running on the server.”

For an administrator, the actionable point is the potential exposure of heap memory from a privileged server process. The record supplies no mitigation or workaround; its listed remediation is installation of the appropriate Windows update.

Microsoft’s CVE-2026-69803 assessment places the priority on routine but prompt patching​

Microsoft’s current status fields for CVE-2026-69803 are:

• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Microsoft’s exploitation assessment is “Exploitation Unlikely.” That assessment can help security teams sequence deployment, particularly where update testing windows are tightly controlled, but it does not remove the need to deploy the fixes. The advisory explicitly identifies a network-based disclosure path and supplies fixed builds for every affected product entry.

The affected list is concentrated in Windows Server versions commonly used for infrastructure services, from Windows Server 2012 through Windows Server 2025. Windows 10 Version 1607 and Windows 10 Version 1809 entries are also listed. The same KB may apply to both a desktop Windows release and its corresponding server release, but administrators should match the update to the exact product and installation type in their estate.

Windows Server 2012 through Windows Server 2025 receive distinct CVE-2026-69803 fixed builds​

Microsoft’s remediation data pairs each affected Windows product with a required KB and a resulting fixed build. Server Core and full server installations are separate affected-product entries even when they share the same package and build target.

The build number is the important verification point after deployment. A system that has received an update through a managed servicing process should still be checked against its applicable fixed build, because the KB-to-build mapping is Microsoft’s explicit measure of remediation for this CVE.

CVE-2026-69803 remediation requires matching each installation to its Microsoft KB​

For Windows 10 Version 1607 for 32-bit Systems (x86), install KB5123099 to reach fixed build 10.0.14393.9512. For Windows 10 Version 1607 for x64-based Systems, install KB5123099 to reach fixed build 10.0.14393.9512.

For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5122876 to reach fixed build 10.0.17763.9245. For Windows 10 Version 1809 for x64-based Systems, install KB5122876 to reach fixed build 10.0.17763.9245.

For Windows Server 2012 (Server Core installation) (x64), install KB5123065 to reach fixed build 6.2.9200.26349. For Windows Server 2012 (x64), install KB5123065 to reach fixed build 6.2.9200.26349.

For Windows Server 2012 R2 (Server Core installation) (x64), install KB5123066 to reach fixed build 6.3.9600.23397. For Windows Server 2012 R2 (x64), install KB5123066 to reach fixed build 6.3.9600.23397.

For Windows Server 2016 (Server Core installation) (x64), install KB5123099 to reach fixed build 10.0.14393.9512. For Windows Server 2016 (x64), install KB5123099 to reach fixed build 10.0.14393.9512.

For Windows Server 2019 (Server Core installation) (x64), install KB5122876 to reach fixed build 10.0.17763.9245. For Windows Server 2019 (x64), install KB5122876 to reach fixed build 10.0.17763.9245.

For Windows Server 2022 (Server Core installation) (x64), install KB5122882 to reach fixed build 10.0.20348.5622. For Windows Server 2022 (x64), install KB5122882 to reach fixed build 10.0.20348.5622.

For Windows Server 2025 (Server Core installation) (x64), install KB5122871 to reach fixed build 10.0.26100.33438. For Windows Server 2025 (x64), install KB5122871 to reach fixed build 10.0.26100.33438.

What this means for you​

Administrators should prioritize identifying affected Windows DHCP Server deployments, deploy the corresponding KB through their normal update process, and verify that each server reaches Microsoft’s stated fixed build.

• CVE-2026-69803 is an Important Windows DHCP Server Information Disclosure Vulnerability with a CVSS base score of 5.9 and temporal score of 5.2.
• The weakness is CWE-125, and Microsoft describes it as an out-of-bounds read that may allow an unauthorized attacker to disclose information over a network.
• Microsoft’s assessment is “Exploitation Unlikely,” while its status fields read Publicly disclosed: No and Exploited: No.
• Windows Server 2012 and Windows Server 2012 R2 require KB5123065 and KB5123066 respectively, with distinct target builds for each release.
• Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 require KB5123099, KB5122876, KB5122882, and KB5122871 respectively.
• Customer action required: Yes, and Microsoft’s listed remediation is to install the matching update and reach the designated fixed build.

CVE-2026-69803 does not call for a speculative response: Microsoft has provided a defined patch path for each affected release. Organizations that maintain DHCP Server roles on the listed Windows versions should treat the KB and build mapping as the deployment checklist, with special attention to Server Core systems that may be easy to overlook in routine desktop-focused update reporting.