Install Microsoft Patch to Stop Unauthenticated Remote Code in Windows DHCP Server Flaw
An unpatched flaw in Windows DHCP Server allows attackers to run code remotely. Microsoft has released a fix for supported versions.
Key points
- Microsoft identified a remote code execution vulnerability in the Windows DHCP Server component.
- The flaw allows unauthorized attackers to execute code over a network without prior authentication.
- A security update is available for supported versions of the Windows operating system.
Microsoft has released a security update to address a remote code execution vulnerability in the Windows DHCP Server. This flaw allows an attacker to run arbitrary code on a targeted server over a network. The issue stems from how the server handles certain network requests. Attackers do not need to log in or have valid credentials to exploit this weakness. The vulnerability is tracked as CVE-2026-70058.
In plain English
A remote code execution flaw means a hacker can take control of a computer from afar. In this case, the target is the DHCP Server, which assigns IP addresses to devices on a network. If an attacker sends a specially crafted request to this server, they can force it to run malicious programs. This happens because the server writes data beyond the memory space allocated for it, known as an out-of-bounds write.
The background
Microsoft’s Security Update Guide describes the issue as an out-of-bounds write in the Windows DHCP Server. This type of error occurs when software writes data to a memory location that is not intended for that data. According to Microsoft, this allows an unauthorized attacker to execute code over a network. The company has provided an advisory for this issue. No specific date was provided for the initial discovery.
What changes now
System administrators must apply the latest security updates to their Windows servers. Microsoft has provided a fix for supported versions of the operating system. Applying this patch corrects the way the DHCP Server processes network requests. This prevents the out-of-bounds write condition from occurring. Older versions of Windows Server that are no longer supported by Microsoft may remain vulnerable.
Key terms explained
Understanding this issue requires knowing how network services handle data. DHCP servers automatically assign IP addresses to devices, making them critical infrastructure. An out-of-bounds write happens when a program places data in the wrong memory area, potentially overwriting other instructions. Remote code execution allows attackers to run commands on a target machine without physical access. Teams usually monitor these services for unusual traffic patterns.
What to do and how to stay safe: Microsoft
- Verify if your organization runs Windows DHCP Server on any network segments.
- Check the installed Windows version against Microsoft’s list of supported updates.
- Apply the latest security patch to all supported DHCP server instances immediately.
- Monitor network logs for unusual DHCP request patterns that could indicate probing.
Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is identified as CVE-2026-70058.
Does this flaw require attacker authentication?
No, the source material states it allows an unauthorized attacker to execute code.
Is a fix available for all Windows versions?
Microsoft has released an update for supported versions, but legacy systems may not be covered.
