CVE-2026-96934

⚠️ Windows DHCP : CVE-2026-96934 (CVSS 9,8) permet une exécution de code à distance sans authentification, notamment en mode failover. Aucune exploitation confirmée. Correctif disponible depuis le 13/10 : mettez à jour vos serveurs DHCP. #Cyber #WindowsServer

#NØØT_Security_Alerts 🚨 #ALERT — MICROSOFT WINDOWS DHCP SERVER: CRITICAL UNAUTHENTICATED REMOTE CODE EXECUTION — CVSS 9.8 October 13, 2026 DISCLOSED BY: Microsoft Security Response Center PRODUCT: Windows DHCP Server CVE: CVE-2026-96934 SEVERITY: CRITICAL — CVSS 3.1: 9.8 WEAKNESS: CWE-416 — Use After Free AFFECTED VERSIONS: Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including affected Server Core installations. Microsoft also identifies specific legacy Windows 10 builds. IMPACT: A use-after-free vulnerability in Windows DHCP Server could allow an unauthenticated remote attacker to execute arbitrary code on an affected system. EXPOSURE: Requires network access to a vulnerable DHCP Server service. Microsoft’s assessment specifies low attack complexity, no required privileges and no user interaction. Installing Windows Server alone does not establish exposure; verify whether the vulnerable service is running and reachable. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL RCE VULNERABILITY. No verified exploitation in the wild or independently demonstrated public working PoC. CISA’s October 13 vulnerability enrichment records: Exploitation: None Automatable: Yes Technical Impact: Total These assessments do not establish actual compromise. Forensic triage: Review DHCP service logs, unexpected service crashes, abnormal restarts and suspicious execution activity on DHCP servers. Correlate anomalous traffic with endpoint and system telemetry. No CVE-specific malicious IOCs have been established. URGENT ACTION: Deploy Microsoft’s October 13 security updates. Prioritize vulnerable production DHCP servers. Restrict unnecessary network exposure, review DHCP service permissions and investigate suspicious activity. Verify installation of the applicable fixed Windows build. SOURCE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96934 OFFICIAL MICROSOFT CVE RECORD: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96934.json CONFIDENCE: HIGH — Microsoft-authored CVE record confirms the vulnerability, network attack vector, CVSS 9.8 severity and affected platforms. UNVERIFIED — Real-world exploitation, working public exploit and victim compromise. #CyberSecurity #ThreatIntel #Microsoft #WindowsServer #DHCP #RCE #NetworkSecurityً