CVE-2026-44815Disclosure(microsoft / windows_10_1607)

MEDIUMCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 4 mentions and remains active

Immediate actions

Patch microsoft windows_10_1607 systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code over a network.

microsoft CVEs Back to dashboard

4.8/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44815

Weakness type (CWE)

CWE-121

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2

Threat summary

Active exploitation appears in 2 classified signals
Patch or workaround signal is available
15 mentions across 9 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 10 signals
Disclosure: 7 classified signals
General: 4 classified signals
Peaked 6d ago at 4 mentions (2026-06-11); latest day: 1
15 total mentions across 9 days

Affected systems

Vendors

microsoft

Products

windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2012windows_server_2016

2 versions affected across 13 products

Deep dive

Activity timeline15 mentions / 9d

Signal classification5 categories

Disclosure

746.7%

General

426.7%

Patch

213.3%

Exploit

16.7%

Active Exploitation

16.7%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	2	Disclosure1General1
2026-06-10	3	Disclosure1Exploit1General1
2026-06-11	4	Active Exploitation1Disclosure1General2
2026-06-15	1	Patch1
2026-06-19	1	Disclosure1
2026-06-24	1	Disclosure1
2026-07-03	1	Disclosure1
2026-08-26	1	Patch1
2026-09-15	1	Disclosure1

Full discourse15 posts

Omair 🇵🇸@w3bd3vil136d
Disclosure
CVE-2026-44815 DHCP Client RCE call memcpy; memcpy(out, data, len) <-- NO BOUNDS CHECK rpcrt4!_report_gsfailure+0x129 rpcrt4!Ndr64StubWorker+0x1243 0x41414141`41414141 0x41414141`41414141 0x41414141`41414141 Reaching the trigger requires SCCM managed host?!
Post summary
CVE‑2026‑44815 is a DHCP client RCE caused by an unchecked memcpy in rpcrt4, with details on stack corruption and SCCM‑managed host requirement; no PoC, exploit code, patch, or active exploitation evidence is provided.
31501105711.7K
7.2K followersView on X
Horizon Secured@horizon_secured137d
General
🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗝𝘂𝗻𝗲 𝟮𝟬𝟮𝟲 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆 After just one month without zero-days, we’re back to 𝟯 𝗻𝗲𝘄 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀 and multiple nasty 9+ vulnerabilities. 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆𝘀 🔸 CVE-2026-50507 – BitLocker Security Feature Bypass (YellowKey?) 🔸 CVE-2026-49160 – HTTP.sys Denial of Service 🔸 CVE-2026-45586 – CTFMON Elevation of Privilege 𝟵.𝟬+ 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 🔹 CVE-2026-45602 – Windows DHCP Server Tampering (9.1) 🔹 CVE-2026-42904 – Windows TCP/IP Elevation of Privilege (9.6) 🔹 CVE-2026-44815 – Windows DHCP Client Remote Code Execution (9.8) 🔹 CVE-2026-45657 – Windows Kernel Remote Code Execution (9.8) 🔹 CVE-2026-47291 – HTTP.sys Remote Code Execution (9.8) Full breakdown in this month’s Horizon Alert. #PatchTuesday #CyberSecurity #ZeroDay #Vulnerability #Microsoft
Post summary
The alert highlights a month‑old zero‑day roundup with several high‑severity CVEs, providing basic technical details but no exploitation or mitigation information.
2201761.9K
2.6K followersView on X
National CERT/CC@CERT_UG59d
Patch
🚨 Patch Now | August 26, 2026 Bringing these vulnerabilities to your attention. - Windows DHCP Client (CVE-2026-44815, CVSS 9.8) - Citrix NetScaler (CVE-2026-19490, CVSS 9.3) - macOS Screen Sharing (CVE-2026-65400, CVSS 9.8) https://cert.ug | #CyberSafeUG #CERTUGCC https://t.co/RbZmG83z9v
Post summary
The message is a patch advisory alerting users to critical vulnerabilities in Windows DHCP Client, Citrix NetScaler, and macOS Screen Sharing, urging immediate patching via a provided link.
00050136
1.5K followersView on X
Himanshu Anand@anand_himanshu135d
General
Let us talk CVE-2026-44815 (DHCP Client). You could almost call it WannaCry 2.0. (I know WC was the ransomware & EternalBlue was the exploit) A rogue local DHCP server can compromise systems just like that.
Post summary
The post notes CVE-2026-44815 and likens it to WannaCry, but provides no concrete technical or operational insights.
1000081
571 followersView on X
VulnTracker@vuln_tracker135d
Disclosure
memcpy(out, data, len) - NO BOUNDS CHECK. CVE-2026-44815 - DHCP Client RCE. A network protocol every Windows machine uses just became an attack vector. The stack smash is textbook. The impact is not. SCCM-managed hosts are in scope. That's a lot of enterprise environments. http://VulnTracker.io
Post summary
The post announces CVE-2026-44815, a buffer‑overflow RCE in the Windows DHCP client affecting SCCM‑managed hosts; it provides basic technical details but no PoC, exploit code, or patch information.
00010215
670 followersView on X
Aviatrix Threat Research Center@aviatrixtrc136d
Exploit
TRC analysis shows attackers chaining CVE-2026-47291 (Windows HTTP.sys RCE) with CVE-2026-44815 (DHCP Client overflow) for rapid privilege escalation and lateral movement. This attack path demonstrates how multiple Windows service flaws enable swift network compromise. Runtime segmentation helps contain such post-exploit activity. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/microsoft-patch-tuesday-june-2026-206-cves
Post summary
The analysis reports attackers chaining Windows HTTP.sys RCE (CVE‑2026‑47291) with a DHCP Client overflow (CVE‑2026‑44815) to rapidly elevate privileges and move laterally, but no public exploit code or confirmed active attacks are mentioned.
00010117
1.9K followersView on X
kawn@kawn2020136d
General
#windowsupdate #microsoft つづき・CVE-2026-44815　9.8　Windows DHCP クライアント・CVE-2026-45657　9.8　Windows カーネル・CVE-2026-47291　9.8　Windows HTTP.sys ・CVE-2026-47643　9.8　Azure Stack Edge ・CVE-2026-48567　10　 Azure HorizonDB
Post summary
The tweet lists several 2026 CVEs with their CVSS scores and impacted components, but offers no additional context such as exploitation status, patches, or PoC details.
10000184
85 followersView on X
IntegSec@integ_sec39d
Disclosure
CVE-2026-44815: Windows DHCP Client Remote Code Execution Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04xx2kY0
Post summary
The text discloses a Windows DHCP Client RCE vulnerability by naming the CVE, affected component, and vulnerability type. It does not provide a PoC, exploit tool, active exploitation claim, or explicit remediation detail.
0000039
35 followersView on X
IntegSec@integ_sec113d
Disclosure
CVE-2026-44815: Windows DHCP Client Buffer Overflow - What It Means for Your Business and How to Respond https://hubs.li/Q04nw2zR0
Post summary
The article announces the CVE‑2026‑44815 Windows DHCP Client buffer overflow, outlining potential business impacts and suggested responses.
0000044
32 followersView on X
BT Haberler@BTHaberler122d
Disclosure
Microsoft tarihinin en büyük güncellemelerinden biri: 200+ açık, 6 sıfır gün! Haziran 2026 Patch Tuesday ile Microsoft, aralarında aktif istismar edilen Exchange açığının da bulunduğu 200'den fazla güvenlik açığını kapattı. 40'ı kritik seviyede. • CVE-2026-42897: Exchange + Outlook Web Access açığı — özel hazırlanmış e-posta ile kurbanın tarayıcısında kod çalıştırılabiliyor; tam yama henüz yok. • CVE-2026-45657 / CVE-2026-47291 / CVE-2026-44815: Windows Kernel, HTTP.sys ve DHCP Client'ta CVSS 9.8 — kimlik doğrulaması gerekmeden uzaktan kod yürütme. • YellowKey ve bitskrieg açıkları BitLocker şifrelemesini bypass ediyor. Windows güncellemelerini bugün uygulayın — Exchange kullanıyorsanız özellikle! #SiberGüvenlik #Microsoft #PatchTuesday
Post summary
Microsoft released a major Patch Tuesday with over 200 CVEs, including an actively exploited Exchange flaw, and the patches are available—although a specific fix for CVE‑2026‑42897 is still pending.
0000062
36 followersView on X
Action1@Action1corp127d
Disclosure
Not every critical vulnerability requires a user to click a link or open a file. CVE-2026-44815 is a reminder that core network services can become a pathway to compromise when left unpatched. As Alex Vovk highlights in The Hacker News coverage by Ravie Lakshmanan, this Windows DHCP Client vulnerability could allow remote code execution through specially crafted network traffic, without requiring credentials or user interaction. When a vulnerability affects a service as fundamental as DHCP, the impact can extend far beyond a single system, making timely patching a priority. https://hubs.ly/Q04m1WXV0 #PatchTuesday #VulnerabilityManagement Action1 #PatchManagement #MicrosoftSecurity
Post summary
The post discloses CVE‑2026‑44815 as a Windows DHCP Client remote code execution flaw triggered by crafted packets, highlighting the need for patching while providing no PoC or evidence of active exploitation.
00000116
611 followersView on X
平良俊也🌗セキュリティの仕事してる沖縄の人@shunyat1031131d
Patch
優先すべき脆弱性の例 CVSS 9.8の認証不要RCE等危険なものも出ています・CVE-2026-47291(HTTP.sys) ・CVE-2026-45657(Win Kernel) ・CVE-2026-41089(Netlogon) ・CVE-2026-44815（Windows DHCP Client）詳細はNVDなど参照パッチや緩和策の適用状況のご確認を #脆弱性 #セキュリティ #microsoft
Post summary
The post lists several high‑severity Windows CVEs, noting their CVSS 9.8 unauthenticated RCE nature, and urges readers to verify and apply available patches or mitigations.
00000117
368 followersView on X
Himanshu Anand@anand_himanshu135d
General
Read the full post here: https://blog.himanshuanand.com/2026/06/reading-a-patch-tuesday-diff-for-fun-the-dhcp-client-memcpy-that-copies-more-than-four-bytes-cve-2026-44815/ Hit me up if you have any questions! #InfoSec #Vulnerability #PatchTuesday #CVE
Post summary
The tweet merely links to a blog post on a CVE and offers no detailed information, PoC, or patch guidance.
0000059
571 followersView on X
VulDB 🛡@vuldb135d
Active Exploitation
It is possible to see elevated activities targeting Microsoft Windows (CVE-2026-44815) https://vuldb.com/vuln/369652/cti
Post summary
The post notes observed increased activity targeting Microsoft Windows for CVE-2026-44815, implying possible exploitation, but offers no patches or technical details.
0000063
2.2K followersView on X
VulDB 🛡@vuldb137d
Disclosure
A new vulnerability with increased severity was disclosed for Microsoft Windows (CVE-2026-44815) https://vuldb.com/vuln/369652
Post summary
Microsoft Windows vulnerability CVE-2026-44815 has been disclosed with increased severity, but no further details or actionable information are provided.
0000053
2.2K followersView on X

CPE platform detail24 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

24 of 24 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1607	-	-	x64
OS	microsoft	windows_10_1607	-	-	x86
OS	microsoft	windows_10_1809	-	-	x64
OS	microsoft	windows_10_1809	-	-	x86
OS	microsoft	windows_10_21h2	-	-	arm64
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_21h2	-	-	x86
OS	microsoft	windows_10_22h2	-	-	arm64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x86
OS	microsoft	windows_11_23h2	-	-	arm64
OS	microsoft	windows_11_23h2	-	-	x64
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2012	-	-	-
OS	microsoft	windows_server_2012	r2	-	-
OS	microsoft	windows_server_2016	-	-	-
OS	microsoft	windows_server_2019	-	-	-
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_2025	-	-	x64

Explore more

Back to dashboard microsoft CVEs windows_10_1607 vulnerabilities

What researchers are saying

CVE-2026-44815

Horizon Secured[verified]@horizon_securedGeneral

The alert highlights a month‑old zero‑day roundup with several high‑severity CVEs, providing basic technical details but no exploitation or mitigation information.

VulnTracker[verified]@vuln_trackerDisclosure

The post announces CVE-2026-44815, a buffer‑overflow RCE in the Windows DHCP client affecting SCCM‑managed hosts; it provides basic technical details but no PoC, exploit code, or patch information.

Aviatrix Threat Research Center[verified]@aviatrixtrcExploit

The analysis reports attackers chaining Windows HTTP.sys RCE (CVE‑2026‑47291) with a DHCP Client overflow (CVE‑2026‑44815) to rapidly elevate privileges and move laterally, but no public exploit code or confirmed active attacks are mentioned.

IntegSec[verified]@integ_secDisclosure

The text discloses a Windows DHCP Client RCE vulnerability by naming the CVE, affected component, and vulnerability type. It does not provide a PoC, exploit tool, active exploitation claim, or explicit remediation detail.

IntegSec[verified]@integ_secDisclosure

The article announces the CVE‑2026‑44815 Windows DHCP Client buffer overflow, outlining potential business impacts and suggested responses.

BT Haberler[verified]@BTHaberlerDisclosure

Microsoft released a major Patch Tuesday with over 200 CVEs, including an actively exploited Exchange flaw, and the patches are available—although a specific fix for CVE‑2026‑42897 is still pending.

Action1[verified]@Action1corpDisclosure

The post discloses CVE‑2026‑44815 as a Windows DHCP Client remote code execution flaw triggered by crafted packets, highlighting the need for patching while providing no PoC or evidence of active exploitation.

Omair 🇵🇸@w3bd3vilDisclosure

CVE‑2026‑44815 is a DHCP client RCE caused by an unchecked memcpy in rpcrt4, with details on stack corruption and SCCM‑managed host requirement; no PoC, exploit code, patch, or active exploitation evidence is provided.