{"id":"CVE-2026-96134","kind":"vulnerability","aliases":["CVE-2026-96134"],"related":[],"title":"Windows DHCP Server: network attacker can exhaust resources and stop service","description":"Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.","summary":"Windows DHCP Server consumes resources without limit when handling network requests. An unauthorized attacker on the network can make the service unavailable, denying DHCP to clients.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcp","infrastructure","self-hosted","windows","windows-server"],"not_affected_if":["dhcp-hosted-elsewhere","dhcp-role-not-installed","no-dhcp-role"],"how_to_check":"Run Get-WindowsFeature DHCP on each Windows Server; if the DHCP Server role is not installed, there is no DHCP service to attack. If it is, compare the installed build with the fixed build in the MSRC Security Update Guide entry for CVE-2026-96134 (fixed builds not confirmed yet). Install the November 2026 cumulative update once the KB is confirmed.","fix":null,"status":"open","published_at":"2026-11-10T19:22:10+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","triaged_at":"2026-11-10T19:42:51+00:00","updated_at":"2026-11-10T20:08:07+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:42:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DHCP Server: network attacker can exhaust resources and stop service","impact":"low","summary":"Windows DHCP Server consumes resources without limit when handling network requests. An unauthorized attacker on the network can make the service unavailable, denying DHCP to clients.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server","dhcp","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"DHCP service becomes unavailable, denying network addresses to clients","analyst_note":"Find the Microsoft advisory for CVE-2026-96134 to get affected builds and the patch; the NVD entry gives only the description.","how_to_check":"- Check whether the host runs the DHCP Server role on Windows Server (`Get-WindowsFeature DHCP` in PowerShell)\n- Confirm the build with `winver` or `Get-ComputerInfo` against the Microsoft update list\n- unknown for the affected build ranges, as the sources do not list them","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["dhcp-role-not-installed","dhcp-hosted-elsewhere"],"who_is_affected":"Only servers running the Windows DHCP Server role are exposed, and the attacker needs network reach to the DHCP service. Machines not running that role can skip it. The sources do not list affected builds or a patch.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4496,"output_tokens":552,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-96134 to get affected builds and the patch; the NVD entry gives only the description.","search":"'-2026':13A,16A '-96134':14A,17A 'allow':60C 'attack':5A,40B,63C 'client':52B 'consum':30B 'consumpt':55C 'cve':12A,15A 'deni':49B,65C 'dhcp':2A,18B,28B,50B,58C 'exhaust':7A 'handl':35B 'host':22B 'infrastructur':19B 'limit':33B 'make':45B 'network':4A,36B,43B,69C 'request':37B 'resourc':8A,31B,54C 'self':21B 'self-host':20B 'server':3A,26B,29B,59C 'servic':11A,47B,66C 'stop':10A 'unauthor':39B,62C 'unavail':48B 'uncontrol':53C 'window':1A,23B,25B,27B,57C 'windows-serv':24B 'without':32B","nicknames":[],"mitigations":[],"who_affected":"Only servers running the Windows DHCP Server role are exposed, and the attacker needs network reach to the DHCP service. Machines not running that role can skip it. The sources do not list affected builds or a patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dhcp","high","infrastructure","selfhosted","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96134':14A,17A 'attack':5A 'cve':12A,15A 'dhcp':2A 'exhaust':7A 'network':4A 'resourc':8A 'server':3A 'servic':11A 'stop':10A 'window':1A","search_b":"'attack':40B 'client':52B 'consum':30B 'deni':49B 'dhcp':18B,28B,50B 'handl':35B 'host':22B 'infrastructur':19B 'limit':33B 'make':45B 'network':36B,43B 'request':37B 'resourc':31B 'self':21B 'self-host':20B 'server':26B,29B 'servic':47B 'unauthor':39B 'unavail':48B 'window':23B,25B,27B 'windows-serv':24B 'without':32B","search_c":"'allow':60C 'attack':63C 'consumpt':55C 'deni':65C 'dhcp':58C 'network':69C 'resourc':54C 'server':59C 'servic':66C 'unauthor':62C 'uncontrol':53C 'window':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96134","severity":null,"published_at":"2026-11-10T19:22:10+00:00","modified_at":"2026-11-10T19:22:10+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","fetched_at":"2026-11-10T19:25:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96134:2609","url":null,"severity":null,"published_at":"2026-11-10T20:08:07+00:00","modified_at":"2026-11-10T20:08:07+00:00","first_seen_at":"2026-11-10T20:08:07+00:00","fetched_at":"2026-11-10T20:08:07+00:00","note":"MSRC advisory/NVD/CVRF not retrievable via web-cli (empty or JS-only); only a CVE-record mirror (casco.com) confirms 'Windows DHCP Server Denial of Service Vulnerability', uncontrolled resource consumption, CVSS 7.5, updated 2026-11-10. Likely Nov 2026 Patch Tuesday but no build numbers or KB read. Siblings CVE-2026-77494/96934 are different bugs, not used. Nothing verified; fix unknown. Settle by opening the MSRC page in a browser."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}