Unauthenticated RCE in Windows DHCP Server Exposes Networks to Remote Attacks
An out-of-bounds write flaw in Microsoft’s DHCP service lets attackers execute code over a network without credentials, posing risks to server infrastructure.
Key points
- The vulnerability is tracked as CVE-2026-70058 in the Windows DHCP Server.
- Attackers can exploit the flaw remotely without needing any user authentication.
- Microsoft classifies the issue as a remote code execution risk in its advisory.
Microsoft has identified a remote code execution vulnerability in the Windows DHCP Server component, designated as CVE-2026-70058. This flaw allows an unauthorized attacker to execute arbitrary code over a network, posing a direct threat to organizations relying on Microsoft’s dynamic host configuration protocol infrastructure for network management.
The underlying technical cause is an out-of-bounds write error within the DHCP service. According to Microsoft’s security update guide, this defect enables network-based exploitation without requiring the attacker to provide valid credentials. This unauthenticated access vector significantly lowers the barrier for potential abuse by threat actors targeting server environments.
Technical context
The Microsoft advisory describes the flaw specifically as an out-of-bounds write condition. In software security terms, this type of error often occurs when a program writes data beyond the allocated memory buffer, potentially allowing an attacker to overwrite critical memory structures. The vendor has published details to alert administrators, though the advisory does not provide specific version numbers or a confirmed patch release in the provided material.
Affected systems
The vulnerability resides in the Windows DHCP Server service. This component is typically deployed on Windows Server operating systems that manage IP address assignments within an organization’s network. Any environment using Microsoft’s DHCP implementation is potentially exposed to this remote code execution risk, as the flaw is inherent to the service architecture described in the advisory.
Defender's checklist
Security teams should inventory all systems running the Windows DHCP Server service. Verify the current patch level of these servers against Microsoft’s latest guidance. Monitor network logs for unusual DHCP traffic patterns that may indicate exploitation attempts. Ensure that network segmentation limits the exposure of DHCP servers to untrusted networks.
Operational impact
Organizations should immediately assess their DHCP server inventory to determine exposure. IT managers need to inform network operations teams about the unauthenticated nature of this risk. Procurement and supplier management groups should verify if third-party managed services rely on vulnerable Windows DHCP infrastructure. Internal audit teams must update risk registers to reflect this remote code execution threat.
What to do and how to stay safe: Microsoft
- Scan your network to identify all servers hosting the Windows DHCP service.
- Monitor network traffic for abnormal DHCP request volumes or malformed packets.
- Restrict access to DHCP servers using strict firewall rules until an update is available.
- Review vendor communications for official patching guidance once released.
Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-70058?
It is a remote code execution vulnerability in the Windows DHCP Server caused by an out-of-bounds write error.
Does the attacker need login credentials?
No, the source material states the attacker is unauthorized and can exploit the flaw over a network without authentication.
Is there a confirmed fix available?
The provided source material does not state that a patch or fix has been released or confirmed for this specific CVE.
