Vulnerability record · CVE-2024-26212 · published 9 April 2024
CVE-2024-26212: Microsoft Windows DHCP Server Service uncontrolled resource consumption DoS
Microsoft · Windows Server 2008
The Windows DHCP Server Service contains an uncontrolled resource consumption flaw (CWE-400) that allows a remote, unauthenticated attacker to cause a denial of service. The record gives only a one-line description and no technical detail on the specific resource or trigger, so the exact mechanism is not documented here.
Description
DHCP Server Service Denial of Service Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote, unauthenticated availability impact on a core network service across many supported Windows Server versions, with very high EPSS despite no KEV listing.
What it is
The Windows DHCP Server Service contains an uncontrolled resource consumption flaw (CWE-400) that allows a remote, unauthenticated attacker to cause a denial of service. The record gives only a one-line description and no technical detail on the specific resource or trigger, so the exact mechanism is not documented here.
Impact
An attacker can degrade or halt DHCP service on the affected server, disrupting IP address assignment for clients on that network segment. The vector shows no confidentiality or integrity impact, only availability loss.
Attack surface
Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), meaning the DHCP service itself is the entry point. Any host able to send traffic to the DHCP server can attempt it.
Exploitation
Not listed in CISA KEV and no public exploit or PoC is referenced; EPSS is high at 0.62576 (99.15th percentile), indicating elevated predicted exploitation likelihood despite the absence of confirmed in-the-wild activity.
What to do
- Apply the Microsoft April 2024 security update for CVE-2024-26212 on all affected Windows Server versions.
- If DHCP Server Service is not required on a host, disable or remove the role to eliminate exposure.
- Restrict network access to DHCP servers to trusted internal segments and block DHCP traffic from untrusted or external networks.
- Monitor DHCP server resource usage and restart or fail over the service if it becomes unresponsive.
Detection
- Alert on DHCP Server Service crashes, unexpected restarts, or service stop events in the System and Application logs.
- Monitor DHCP server CPU, memory, and handle counts for abnormal growth or exhaustion patterns.
- Baseline and alert on unusual volumes or sources of DHCP request traffic reaching the server.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26212 | Vendor Advisory |
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26212 | Vendor Advisory |
Track CVE-2024-26212 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-26212), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
