{"id":"CVE-2026-72998","kind":"vulnerability","aliases":["CVE-2026-72998"],"related":[],"title":"Windows DHCP Server: use-after-free lets a network attacker run code","description":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","summary":"A memory-handling bug in the Windows DHCP Server role lets an unauthorized attacker on the network trigger a use-after-free and run code on the server. The sources give a CVSS score of 8.1 and do not describe a public exploit.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcp","infrastructure","windows","windows-server"],"not_affected_if":["dhcp-client-only","dhcp-served-by-non-windows"],"how_to_check":"- Check whether the DHCP Server role is installed on Windows Server hosts, for example with `Get-WindowsFeature DHCP` in PowerShell.\n- Confirm the build against Microsoft's security update guide for CVE-2026-72998: unknown.","fix":null,"status":"open","published_at":"2026-11-10T19:21:21+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","triaged_at":"2026-11-10T19:34:36+00:00","updated_at":"2026-11-10T19:34:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:34:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DHCP Server: use-after-free lets a network attacker run code","impact":"high","summary":"A memory-handling bug in the Windows DHCP Server role lets an unauthorized attacker on the network trigger a use-after-free and run code on the server. The sources give a CVSS score of 8.1 and do not describe a public exploit.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server","dhcp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker runs code on the DHCP server","analyst_note":"Find the affected Windows Server builds and the Microsoft fixed update for CVE-2026-72998 in the MSRC security update guide, and whether the DHCP Server role is required to trigger it.","how_to_check":"- Check whether the DHCP Server role is installed on Windows Server hosts, for example with `Get-WindowsFeature DHCP` in PowerShell.\n- Confirm the build against Microsoft's security update guide for CVE-2026-72998: unknown.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["dhcp-client-only","dhcp-served-by-non-windows"],"who_is_affected":"Systems running the Windows DHCP Server role are exposed to network attackers who can send crafted DHCP traffic to them. Machines that only act as DHCP clients, or networks that serve addresses from a router or appliance rather than Windows, are not affected by this flaw. The sources do not state the affected build ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4480,"output_tokens":595,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows Server builds and the Microsoft fixed update for CVE-2026-72998 in the MSRC security update guide, and whether the DHCP Server role is required to trigger it.","search":"'-2026':15A,18A '-72998':16A,19A '8.1':63B 'allow':78C 'attack':11A,40B,81C 'bug':30B 'code':13A,52B,84C 'cve':14A,17A 'cvss':60B 'describ':67B 'dhcp':2A,20B,34B,76C 'execut':83C 'exploit':70B 'free':7A,49B,73C 'give':58B 'handl':29B 'infrastructur':21B 'let':8A,37B 'memori':28B 'memory-handl':27B 'network':10A,43B,87C 'public':69B 'role':36B 'run':12A,51B 'score':61B 'server':3A,25B,35B,55B,77C 'sourc':57B 'trigger':44B 'unauthor':39B,80C 'use':5A,47B,71C 'use-after-fre':4A,46B 'window':1A,22B,24B,33B,75C 'windows-serv':23B","nicknames":[],"mitigations":[],"who_affected":"Systems running the Windows DHCP Server role are exposed to network attackers who can send crafted DHCP traffic to them. Machines that only act as DHCP clients, or networks that serve addresses from a router or appliance rather than Windows, are not affected by this flaw. The sources do not state the affected build ranges.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dhcp","high","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':15A,18A '-72998':16A,19A 'attack':11A 'code':13A 'cve':14A,17A 'dhcp':2A 'free':7A 'let':8A 'network':10A 'run':12A 'server':3A 'use':5A 'use-after-fre':4A 'window':1A","search_b":"'8.1':63B 'attack':40B 'bug':30B 'code':52B 'cvss':60B 'describ':67B 'dhcp':20B,34B 'exploit':70B 'free':49B 'give':58B 'handl':29B 'infrastructur':21B 'let':37B 'memori':28B 'memory-handl':27B 'network':43B 'public':69B 'role':36B 'run':51B 'score':61B 'server':25B,35B,55B 'sourc':57B 'trigger':44B 'unauthor':39B 'use':47B 'use-after-fre':46B 'window':22B,24B,33B 'windows-serv':23B","search_c":"'allow':78C 'attack':81C 'code':84C 'dhcp':76C 'execut':83C 'free':73C 'network':87C 'server':77C 'unauthor':80C 'use':71C 'window':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-72998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72998","severity":null,"published_at":"2026-11-10T19:21:21+00:00","modified_at":"2026-11-10T19:21:21+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","fetched_at":"2026-11-10T19:25:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}