{"id":"CVE-2026-69405","aliases":[],"cve":{"records":[{"id":"CVE-2026-69405","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-03T20:57:58.963Z","published":"2026-09-08T17:15:29.498Z","modified":"2026-10-30T21:53:56.052Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-10-30T21:53:56.052Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-08T20:48:56.229Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69405","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-401","description":"CWE-401: Missing Release of Memory after Effective Lifetime","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9245"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9245"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9245"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.20348.0","versionEndExcluding":"10.0.20348.5622"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33438"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33438"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9512"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9512"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9512"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*","versionStartIncluding":"6.2.9200.0","versionEndExcluding":"6.2.9200.26349"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*","versionStartIncluding":"6.2.9200.0","versionEndExcluding":"6.2.9200.26349"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*","versionStartIncluding":"6.3.9600.0","versionEndExcluding":"6.3.9600.23398"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*","versionStartIncluding":"6.3.9600.0","versionEndExcluding":"6.3.9600.23398"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-08T20:39:45.346885Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Windows DHCP Server Denial of Service Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.","score":5.7,"severity":"medium","published":"2026-09-08T17:15:29.498Z","modified":"2026-10-30T21:53:56.052Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Windows 10 Version 1607","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9512","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows 10 Version 1809","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9245","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2012","platforms":["x64-based Systems"],"versions":[{"version":"6.2.9200.0","status":"affected","lessThan":"6.2.9200.26349","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2012 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"6.2.9200.0","status":"affected","lessThan":"6.2.9200.26349","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2012 R2","platforms":["x64-based Systems"],"versions":[{"version":"6.3.9600.0","status":"affected","lessThan":"6.3.9600.23398","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2012 R2 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"6.3.9600.0","status":"affected","lessThan":"6.3.9600.23398","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2016","platforms":["x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9512","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2016 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9512","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2019","platforms":["x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9245","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2019 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9245","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2022","platforms":["x64-based Systems"],"versions":[{"version":"10.0.20348.0","status":"affected","lessThan":"10.0.20348.5622","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2025","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33438","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"},{"vendor":"Microsoft","name":"Windows Server 2025 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33438","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69405"],"sources":[{"name":"CVE","id":"CVE-2026-69405","modified":"2026-10-30T21:53:56.052Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","score":5.7}],"sourceAffected":[],"observedAt":"2026-10-30T22:37:28.184Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:20:32.820Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-31T10:50:31.349Z","attemptedAt":"2026-10-31T10:50:31.349Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-31T10:50:32.388Z","attemptedAt":"2026-10-31T10:50:32.388Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-31T10:50:32.384Z","attemptedAt":"2026-10-31T10:50:32.384Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-31T10:50:32.379Z","attemptedAt":"2026-10-31T10:50:32.379Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-69405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69405","modified":"2026-09-24T23:17:46.917","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-31T10:50:31.349Z"},{"source":"FIRST EPSS","id":"CVE-2026-69405","url":"https://www.first.org/epss/","probability":0.00646,"percentile":0.50945,"date":"2026-10-30","checkedAt":"2026-10-31T10:50:32.379Z"},{"source":"ENISA EUVD","id":"EUVD-2026-73490","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73490","modified":"Oct 30, 2026, 9:53:56 PM","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","checkedAt":"2026-10-31T10:50:32.384Z"},{"source":"GitHub Advisory Database","id":"GHSA-rcpq-5hxq-5829","url":"https://github.com/advisories/GHSA-rcpq-5hxq-5829","modified":"2026-09-08T18:32:40Z","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-31T10:50:32.388Z"}],"aiSummary":{"text":"A denial of service vulnerability in Windows DHCP Server, due to missing release of memory after effective lifetime, allows an authorized attacker to deny service over an adjacent network, affecting various Windows versions. The weakness is described as CWE-401. The impact is a denial of service.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T02:26:13.914Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-69405"}]}}