CVE-2026-45602

What it actually does

This is a network-reachable improper input validation flaw in Windows DHCP Server. An unauthenticated attacker can send crafted DHCP traffic to the server and cause unauthorized tampering with DHCP-related data or behavior. Because DHCP is commonly reachable over UDP/67 from local network segments and via DHCP relay agents, exposure depends on where Windows DHCP Server is deployed and which relay paths can reach it. The CVSS vector indicates low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact, with no direct availability impact assessed.

Why it matters to the business

Compromise of DHCP infrastructure can affect how endpoints receive network configuration, potentially enabling traffic redirection, unauthorized configuration changes, exposure of network information, or broader network trust abuse. Since DHCP is foundational for endpoint connectivity, successful exploitation may undermine network segmentation, incident response visibility, and client trust in assigned network settings. Although this issue is not currently listed in CISA KEV and has low EPSS at the time of assessment, the high CVSS score and unauthenticated network attack surface make timely remediation important for organizations running Windows DHCP Server.

How an attack unfolds

An attacker first identifies a reachable Windows DHCP Server, typically on UDP/67 directly from a local segment or indirectly through a DHCP relay. The attacker then sends specially crafted DHCP packets that exercise insufficient input validation in the DHCP Server service. If the vulnerable code path is reached, the server processes attacker-controlled data in a way that permits unauthorized tampering. Depending on deployment and reachable options, the attacker may be able to alter DHCP-related state, influence client network configuration, or gain access to sensitive DHCP/network information. No authentication or user interaction is required, so exploitation is most plausible from an internal network, guest network, compromised endpoint, adjacent broadcast domain, or any network path where DHCP relay traffic is permitted.

How to fix it

Apply the relevant Microsoft security update for all affected Windows client and server versions that have the DHCP Server role installed or otherwise expose the vulnerable service. Because exact fixed build numbers were not provided in the input, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Intune, or Configuration Manager to identify and deploy the applicable cumulative update for each affected OS version. Prioritize Windows Server systems providing DHCP services, especially servers reachable from user, guest, wireless, datacenter, or relay-connected networks. If immediate patching is not possible, restrict UDP/67 access to trusted DHCP relay agents and authorized network segments, block untrusted DHCP relay paths, disable the DHCP Server role where not required, monitor DHCP traffic for anomalies, and ensure only authorized administrators can modify DHCP configuration.

How to confirm the fix worked

Confirm which systems have the Windows DHCP Server role installed and whether the DHCP Server service is running. Verify that each affected host has received the Microsoft security update corresponding to this vulnerability through Windows Update history, WSUS/Intune/Configuration Manager compliance reporting, or authenticated vulnerability scanning. Confirm that UDP/67 is not reachable from untrusted networks except through approved DHCP relay agents. Review firewall, router, and relay configurations to ensure only expected relay sources can communicate with DHCP servers. After patching, perform an authenticated scan or configuration audit to verify the host is no longer reported as vulnerable, and review DHCP Server logs for abnormal traffic before and after remediation.

Typical attack path

1. Discover Windows DHCP Server instances by scanning for UDP/67, reviewing DHCP relay targets, or observing network configuration traffic.
2. Establish network reachability to the DHCP Server directly or through an authorized DHCP relay path.
3. Send crafted DHCP packets designed to trigger improper input validation in the Windows DHCP Server service.
4. Cause unauthorized tampering with DHCP server state, lease/configuration handling, or related DHCP processing behavior.
5. Use the resulting DHCP manipulation or information exposure to support traffic redirection, network reconnaissance, lateral movement, or follow-on attacks.

How to detect it

To determine whether this was already exploited, review Windows DHCP Server audit logs, DHCP Server Admin and Operational event logs, Windows System logs, firewall logs, DHCP relay logs, router/switch logs, and NetFlow records. Focus on UDP/67 traffic from unexpected source networks, unknown relay agents, abnormal spikes in DHCP message volume, malformed or unusually large DHCP options, repeated failed or unusual lease operations, and configuration changes to scopes, reservations, or DHCP options. Check for DHCP Server service restarts, crashes, or errors around suspicious traffic windows. Compare DHCP configuration backups and administrative change records to identify unauthorized changes. Hunt from the publication date onward, with emphasis on servers reachable from untrusted or broadly accessible segments. No public exploit maturity or named threat actor activity was provided, so detection should focus on behavioral anomalies rather than known exploit signatures.

• C:\Windows\System32\dhcp\DhcpSrvLog-*.log
• Microsoft-Windows-DHCP Server Events/Admin
• Microsoft-Windows-DHCP Server Events/Operational
• DHCPServer
• DHCP Server
• dhcpssvc
• UDP/67
• DHCPDISCOVER
• DHCPREQUEST
• DHCPDECLINE
• DHCPINFORM
• DHCPOFFER
• DHCPACK
• DHCPNAK
• DHCPRELEASE
• Relay Agent Information
• Option 82

What your security team should do

• Inventory all Windows systems with the DHCP Server role enabled and rank them by network exposure, relay reachability, and business criticality.
• Patch exposed Windows DHCP Server systems first, especially domain-connected servers and servers serving user, guest, wireless, VPN, or production networks.
• Restrict DHCP Server access so only trusted local segments and approved DHCP relay agents can send traffic to UDP/67.
• Review DHCP relay configurations on routers, switches, firewalls, and VPN concentrators to remove unnecessary relay paths.
• Enable and centralize Windows DHCP Server audit logs and DHCP Server event logs for detection and post-incident review.
• Hunt for unusual DHCP requests, malformed DHCP options, unexpected relay agent addresses, abnormal lease churn, and unauthorized DHCP option changes since publication.
• Alert on configuration changes to DHCP scopes, options, reservations, relay-related settings, and service restarts outside approved maintenance windows.
• If suspicious activity is found, preserve DHCP audit logs, Windows event logs, firewall/NetFlow records, and configuration backups before remediation changes overwrite evidence.