CVE-2026-56159

DHCP Server is the Windows service that hands out network settings (like IP addresses) to devices. This vulnerability is like a “crash and takeover” flaw in that service: if it’s reachable, a bad actor could send specially crafted network traffic that causes the service to run attacker-controlled code. In a small business, that can mean the attacker gains control of your network infrastructure, not just one workstation.

This matters if your organization runs the Windows DHCP Server service on any of these systems: Windows 10 and Windows Server 2012, 2012 R2, 2016, 2019, 2022, or 2025. If you only use DHCP as a client (your devices request addresses) but do not run a DHCP server, this is generally not your exposure.

Reachability matters: the risk is tied to whether an attacker can reach the DHCP Server service over the network (no login is required per the reported weakness).

This is marked RED because it’s a critical remote code execution issue in a network-facing core service (DHCP Server). Even without confirmed public exploit details in the provided sources, the impact is severe: a remote attacker could gain control of the DHCP server over the network.