MicrosoftCVE-2026-69876

Microsoft Windows DHCP Server: use after free

High8.0CVE-2026-69876 · Published Sep 8, 2026 · updated Sep 24, 2026

Use after free in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Windows 10 Version 1607 Product	>= 10.0.14393.0, < 10.0.14393.9512	10.0.14393.9512
Windows 10 Version 1809 Product	>= 10.0.17763.0, < 10.0.17763.9245	10.0.17763.9245
Windows Server 2012 Product	>= 6.2.9200.0, < 6.2.9200.26349	6.2.9200.26349
Windows Server 2012 (Server Core installation) Product	>= 6.2.9200.0, < 6.2.9200.26349	6.2.9200.26349
Windows Server 2012 R2 Product	>= 6.3.9600.0, < 6.3.9600.23398	6.3.9600.23398
Windows Server 2012 R2 (Server Core installation) Product	>= 6.3.9600.0, < 6.3.9600.23398	6.3.9600.23398
Windows Server 2016 Product	>= 10.0.14393.0, < 10.0.14393.9512	10.0.14393.9512
Windows Server 2016 (Server Core installation) Product	>= 10.0.14393.0, < 10.0.14393.9512	10.0.14393.9512
Windows Server 2019 Product	>= 10.0.17763.0, < 10.0.17763.9245	10.0.17763.9245
Windows Server 2019 (Server Core installation) Product	>= 10.0.17763.0, < 10.0.17763.9245	10.0.17763.9245
Windows Server 2022 Product	>= 10.0.20348.0, < 10.0.20348.5622	10.0.20348.5622
Windows Server 2025 Product	>= 10.0.26100.0, < 10.0.26100.33438	10.0.26100.33438

Details and references

CVSS 3.1: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-415, CWE-416

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Sep 8	Microsoft Skype for Business: spoofing High8.3Sep 8 CVE-2026-696466.0.9319.885+2 more	High8.3	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: cross-site scripting Medium6.5Sep 8 CVE-2026-696426.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: spoofing High7.1Sep 8 CVE-2026-663056.0.9319.885+2 more	High7.1	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: information disclosure Medium6.5Sep 8 CVE-2026-663066.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: integer overflow High7.5Sep 8 CVE-2026-663076.0.9319.885+2 more	High7.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: out-of-bounds read Medium6.5Sep 8 CVE-2026-663086.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.