CVE-2026-69803 is a medium severity flaw in the DHCP Server role in Windows DHCP Server, scored 5.9 by the record. Per the NVD record, it allows an unauthorized attacker to disclose information over a network. The record does not state a fixed build, so use the Microsoft advisory for the update that applies to your version and apply it.
What's affected
The NVD record lists these affected products: Windows 10 1607; Windows 10 1809; Windows Server 2012; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
The record describes the issue this way: Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.
The record gives a CVSS 3.1 base score of 5.9 (MEDIUM), published 2026-09-08, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The vector reads as follows. Access is over the network, attack complexity is high, and privileges required are none. No user interaction is needed. Scope is unchanged. Confidentiality, integrity and availability impact are high, none and none.
Microsoft publishes fixed builds on its Security Update Guide, and that page needs a browser to render, so we could not read it automatically. Take version details from there. Where Microsoft's advisory differs from this record on severity or versions, trust the advisory and note the difference in your own tracking.
How to check if you're exposed
Start with the exact Windows build on each machine, then compare it to the fixed build or KB listed in the Microsoft advisory.
winver
Get-ComputerInfo | Select-Object WindowsProductName, OsVersion, OsBuildNumber
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Then check whether the DHCP Server role is installed at all, because a server without it is not running this component:
Get-WindowsFeature DHCP
Match the output against the advisory's table for your Windows version. If the fixing KB is not in the hotfix list, treat the machine as exposed until you confirm otherwise. For a fleet, run the same query through your endpoint management tool instead of machine by machine.
What to do now
- Read the Microsoft advisory and note the fixing update for each Windows Server version.
- Patch DHCP servers first, because the record scores this one as reachable over the network.
- Restrict who can reach DHCP server ports to your own client networks while patching is pending.
- Confirm the new build on each server and keep the evidence.
Why it matters
CWE-125 (out-of-bounds read) describes a weakness where code reads past the end of a buffer and returns memory it should not expose.
Operating system flaws matter because the component runs with high privileges on every machine that has it, and a fleet is slow to patch. The record's own scoring tells you how to rank this one: read the attack vector and privileges lines above, then compare with the machines you actually run.
Microsoft issued several near identical DHCP Server entries on 2026-09-08: CVE-2026-69803, CVE-2026-69929, CVE-2026-69930 and CVE-2026-70124. They share a description and score, and each is a separate ID, so confirm that the update you deploy lists all four.
The record's kev field is false, so the record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and no fetched advisory said it was exploited. That is a snapshot, not a promise, so keep watching.
Safeguard's Gold page for this CVE tracks the record, and the free in-browser scan can check dependency manifests for related issues. Reachability analysis helps with libraries, though it does not apply to operating system patches.
Quick check
Does this CVE appear in the CISA Known Exploited Vulnerabilities list?
The record's kev field is false, so it is not listed in CISA's catalog as of the record we hold. That can change, so check the catalog if you are prioritizing.
Do I need to act if I do not run DHCP Server?
The record lists Windows client and server products, but the component is the DHCP Server role. If the role is not installed, confirm that with Get-WindowsFeature and still apply the monthly update.
Sources
- Microsoft Security Update Guide entry for CVE-2026-69803 (the page did not return readable advisory text to our automated fetch, so confirm details there)
- NVD record for CVE-2026-69803 as supplied in the Safeguard batch data
Last reviewed: 18 October 2026.
