CVE-2026-72979: Windows DHCP Server Remote Code Execution Vulnerability

Microsoft assigns the issue a CVSS base score of 9.8 and a CVSS temporal score of 8.5.

• Severity: Critical
• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• CWE: CWE-416
• Exploitation assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

What Microsoft says an attacker could do​

Microsoft’s advisory describes the issue as follows: “Windows DHCP Server Remote Code Execution Vulnerability: Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.”

The company further states that an unauthenticated attacker could send a specially crafted packet to an affected service over the network. If exploitation succeeds, the attacker could execute code on the target system. In short: this is a network-reachable server-side bug, not a click-a-link or open-an-attachment scenario.

The CVSS vector reflects that exposure: low attack complexity, no privileges, no user interaction, and potentially high impact to confidentiality, integrity, and availability. DHCP may be the plumbing nobody notices until it fails, but it is still plumbing connected to every client asking where it lives on the network.

Required updates and fixed builds​

Administrators should identify systems running the affected DHCP Server role and deploy the applicable update. Microsoft maps the affected products to the following KBs and fixed builds:

Administrator checklist​

1. Inventory Windows systems that provide DHCP services, including Server Core deployments.
2. Match each DHCP server’s Windows version and architecture to Microsoft’s KB/build mapping.
3. Install the listed cumulative update and confirm the server reaches its specified fixed build.
4. Include redundant or failover DHCP infrastructure in the same remediation plan; a secondary DHCP server is still a server that needs patching.
5. Record the deployed KB and build in patch-management evidence, particularly where older Windows Server versions remain in operational use.

This advisory is notable because the attack described by Microsoft begins with a crafted network packet and does not require an attacker to authenticate or persuade a user to do anything. The pragmatic response is equally straightforward: patch every affected Windows DHCP Server instance to the Microsoft-specified fixed build.