Windows 10 1607 DHCP Server Hit by CVSS 8.0 Vulnerability

Microsoft has disclosed a high-severity remote code execution vulnerability in its Windows DHCP Server, including Windows 10 Version 1607.

A stack-based buffer overflow enables code execution over an adjacent network. The flaw, tracked as CVE-2026-69412, is a stack-based buffer overflow classified under CWE-121. An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server.

The vulnerability carries a CVSS 3.1 base score of 8.0 with the vector AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It is rated Important severity.

Exploitation is considered unlikely with no known attacks in the wild. No public disclosure or known exploitation existed at the time of publication on September 8, 2026. The issue was released on that date according to the Microsoft Security Response Center.

Patches are available but no workarounds are listed. The vulnerability affects Windows 10 Version 1607 among other products. Security updates provide the fix, with no mitigations or workarounds detailed in the advisory.

The disclosure comes directly from the Microsoft Security Response Center update guide for this CVE. Administrators of affected systems are advised to apply the available security updates promptly.