CVE-2026-96934: An Unauthenticated Flaw in the Windows DHCP Server Rated CVSS 9.8 Was Fixed on October 13: Check Whether the Role Is Installed and Which Build Fixes It
On October 13, 2026 Microsoft fixed CVE-2026-96934, a use after free in the Windows DHCP Server that lets an unauthenticated attacker run code by sending one crafted packet over the network. The base score is 9.8 (vector AV:N/AC:L/PR:N/UI:N), the weakness is CWE-416, and the advisory lists no workaround. The only remediation is the security update. I did not cover it in my October Patch Tuesday post, which was about the exploited zero day, so this is the DHCP angle on its own.
Microsoft’s data says exploitation is less likely and that the flaw was neither publicly disclosed nor exploited when I read it. That is a reason for calm, not a reason to skip it. An unauthenticated bug in a network service on a server that hands out addresses to every machine on the segment is the kind of thing you patch in the first window.
Quick guide
- Find out whether the DHCP role is installed with
Get-WindowsFeature DHCP. No role means no DHCP Server service to attack. - Compare your build with the fixed builds in the table below.
- Find DHCP servers you forgot about by listing the ones authorized in Active Directory.
- Install the October 13 update for your edition, or any later cumulative update.
- Plan the reboot, because DHCP clients keep their leases while the server restarts but cannot get new ones.
Fixed builds (from Microsoft’s advisory data)
| Windows Server | Fixed build | Update |
|---|---|---|
| 2025 | 10.0.26100.33650 | KB5126646 |
| 2022 | 10.0.20348.5761 | KB5126655 |
| 2019 | 10.0.17763.9376 | KB5126651 |
| 2016 | 10.0.14393.9612 | KB5126868 |
| 2012 R2 | 6.3.9600.23470 | KB5126836 |
| 2012 | 6.2.9200.26434 | KB5126835 |
I took these from the machine readable advisory Microsoft publishes for the CVE, and Server Core is listed with the same builds. A later cumulative update contains the fix, for example the Server 2025 out of band build 26100.33674 from my post on the October 26 updates. The first four rows are the ones most people still run. Server 2012 and 2012 R2 appear because October 13 was their last security update.
Step 1 to 3: what my lab server shows
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
Select-Object CurrentBuild,UBRGet-WindowsFeature DHCP | Format-Table Name,InstallState -AutoSizeGet-Service | Where-Object Name -eq 'DHCPServer'Test-Path C:\Windows\System32\dhcpssvc.dll$cfg = (Get-ADRootDSE).configurationNamingContext
Get-ADObject -SearchBase "CN=NetServices,CN=Services,$cfg" `
-Filter 'objectClass -eq "dHCPClass"'
My lab domain controller is on build 26100.33296, which is below the fixed 26100.33650, so it does not have this update. It is still not exposed through this flaw, because the DHCP role shows Available (not installed), there is no DHCPServer service, dhcpssvc.dll is not on disk, and no DHCP server is authorized in the directory. The service check and the AD query print nothing, which is how PowerShell answers when there is nothing to list.
The AD query only finds DHCP servers that were authorized in Active Directory. A DHCP server on a standalone machine, a lab box or an old appliance will not show up there, so use it as a lead and not as proof. I did not install the update on the lab server, so I have no after output.
Is failover the trigger?
Some trackers describe the bug as reached through DHCP failover packets. The advisory data I read gives the description as a crafted packet to the service and does not mention failover, so I would not treat a server without failover as safe. Patch every server that has the role.
Caveats
- I have no DHCP server in the lab, so I could not test anything beyond the checks above.
- The fixed build numbers come from Microsoft’s advisory data. Check them against the update page for your edition before you rely on them.
- The advisory says exploitation is less likely. That can change, so watch for exploit reports.
FAQ
What is CVE-2026-96934?
A use after free in the Windows DHCP Server rated CVSS 9.8. An unauthenticated attacker can send a crafted packet over the network and may run code on the server. Microsoft fixed it on October 13, 2026.
Is there a workaround?
The advisory data I read lists none. The only remediation is the security update for your edition.
Am I affected if I do not run the DHCP role?
The flaw is in the DHCP Server service, so a server without the role does not run that code. Check with Get-WindowsFeature DHCP, and still install the cumulative update.
Which build is fixed on Windows Server 2025?
26100.33650 or later, from KB5126646. The out of band build 26100.33674 is later and contains it.
How do I find every DHCP server in my domain?
List the dHCPClass objects under the NetServices container in the configuration partition as shown above. It only shows servers authorized in AD, so also check networks for unauthorized ones.
