---
id: "CVE-2026-96134"
page: "https://infrastack.ai/live/CVE-2026-96134"
kind: "vulnerability"
aliases: ["CVE-2026-96134"]
title: "Windows DHCP Server: network attacker can exhaust resources and stop service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dhcp", "infrastructure", "self-hosted", "windows", "windows-server"]
not_affected_if: ["dhcp-hosted-elsewhere", "dhcp-role-not-installed", "no-dhcp-role"]
published_at: "2026-11-10T19:22:10+00:00"
first_seen_at: "2026-11-10T19:25:31+00:00"
updated_at: "2026-11-10T20:08:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96134", "first_seen_at": "2026-11-10T19:25:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:08:07+00:00"}]
exploit_sources: []
---

# Windows DHCP Server: network attacker can exhaust resources and stop service

Link for people: https://infrastack.ai/live/CVE-2026-96134 (this .md is for agents)

Windows DHCP Server consumes resources without limit when handling network requests. An unauthorized attacker on the network can make the service unavailable, denying DHCP to clients.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run Get-WindowsFeature DHCP on each Windows Server; if the DHCP Server role is not installed, there is no DHCP service to attack. If it is, compare the installed build with the fixed build in the MSRC Security Update Guide entry for CVE-2026-96134 (fixed builds not confirmed yet). Install the November 2026 cumulative update once the KB is confirmed.

## Timeline

- 2026-11-10T19:25:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96134
- 2026-11-10T20:08:07+00:00 analyst — MSRC advisory/NVD/CVRF not retrievable via web-cli (empty or JS-only); only a CVE-record mirror (casco.com) confirms 'Windows DHCP Server Denial of Service Vulnerability', uncontrolled resource consumption, CVSS 7.5, updated 2026-11-10. Likely Nov 2026 Patch Tuesday but no build numbers or KB read. Siblings CVE-2026-77494/96934 are different bugs, not used. Nothing verified; fix unknown. Settle by opening the MSRC page in a browser.

## From the sources

Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_