CVE-2026-50518 is an unauthenticated remote code execution flaw in Windows DHCP Server — no login, no clicks, network access is the only requirement. It got overshadowed, and Microsoft says exploitation is 'more likely.'
When Microsoft's July patch dropped, the security world sprinted toward the two zero-days already being exploited — a SharePoint flaw and an AD FS one. Reasonable: those were confirmed in the wild. But in the rush, a CVSS 9.8 slid past with far less noise, and it's the one I'd lose sleep over. CVE-2026-50518 is an unauthenticated remote code execution flaw in Windows DHCP Server — the service that hands out IP addresses on basically every corporate network on earth — and Microsoft rates it 'exploitation more likely.' No login, no phishing, no user interaction. If an attacker can reach the service, they can run code on it.
0.0/ 10
CVSS severity: Critical
Unauthenticated RCE, network vector, no user interaction — the worst-case profile.
Why a DHCP RCE is a sleeper threat
DHCP isn't glamorous. It's the plumbing that assigns IP addresses when a device joins a network, and precisely because it's invisible infrastructure, its security gets less attention than the applications sitting on top of it. But think about where a DHCP server sits: it listens on the network by design, it's typically a domain-joined Windows Server with broad reach, and it's often co-located with other critical roles. Code execution on a DHCP server is rarely the end goal — it's a foothold in the middle of your network with a clear path toward domain controllers and everything else. That's what makes an unauthenticated 9.8 here more dangerous than the raw description suggests.
The attack profile is the worst kind. The NVD vector — AV:N/AC:L/PR:N/UI:N — reads as: reachable over the network, low complexity, no privileges required, no user interaction. That's the same profile that made wp2shell and the PeopleSoft zero-day so urgent. When the prerequisites collapse to 'can send packets to the service,' a proof-of-concept is usually a matter of when, not if — and 'exploitation more likely' is Microsoft telling you it expects one.
The NVD entry: 9.8 Critical, 'heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.' · NIST National Vulnerability Database (screenshot)
How the attack would work
The path from packet to network foothold
Reach the service
Send crafted DHCP traffic to a reachable Windows DHCP Server. No credentials needed.
Heap overflow
Malformed input overflows a heap buffer in the DHCP service (CVE-2026-50518).
Code execution
The overflow is leveraged to run attacker code in the service's context.
Network foothold
A domain-joined server, mid-network, now under attacker control — a launch point for lateral movement.
Reach the service
Send crafted DHCP traffic to a reachable Windows DHCP Server. No credentials needed.
Heap overflow
Malformed input overflows a heap buffer in the DHCP service (CVE-2026-50518).
Code execution
The overflow is leveraged to run attacker code in the service's context.
Network foothold
A domain-joined server, mid-network, now under attacker control — a launch point for lateral movement.
A memory-corruption RCE on infrastructure isn't the goal — it's the entry point to everything behind it.
What to do
Inventory every server running the DHCP Server role across Windows Server 2012–2025 — including the ones you forgot are also DHCP servers.
Apply the July 2026 security update to those servers now. This is the only real fix for a memory-corruption RCE.
If a server can't be patched immediately, restrict network access to the DHCP service — segment it, firewall it, limit which subnets can reach it.
Review the rest of the July batch: the exploited SharePoint and AD FS zero-days, plus other critical RCEs, belong in the same push.
Quick answers
Is CVE-2026-50518 being exploited in the wild?
No confirmed exploitation at the time of writing — the two July zero-days exploited in the wild were the SharePoint (CVE-2026-56164) and AD FS (CVE-2026-56155) flaws. But Microsoft rates CVE-2026-50518 as 'Exploitation More Likely,' which for an unauthenticated 9.8 RCE means you should treat a proof-of-concept as imminent rather than hypothetical. Patch before it's exploited, not after.
Which servers are affected?
Any Windows Server running the DHCP Server role, across Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. If a server doesn't run the DHCP role it isn't exposed to this specific flaw, but most organisations have at least one or two DHCP servers — and they're easy to forget because the role often rides along on a server doing other jobs.
Can I mitigate without patching?
Partially. You can reduce exposure by restricting which networks can reach the DHCP service — segmentation and firewalling — since the attack is network-based. But DHCP by nature needs to be reachable by clients, so mitigations are imperfect. They buy time; they don't replace the patch. Apply the July update as soon as you can schedule it.
There was a second DHCP CVE — what about CVE-2026-56159?
CVE-2026-56159 is also a 9.8 critical RCE in the DHCP Server service, but Microsoft rates its exploitation as 'Unlikely' versus 'More Likely' for CVE-2026-50518. Both are fixed by the same July update, so patching resolves both at once. Prioritise by the 'more likely' label, but there's no reason to leave either unpatched.
Primary detail is on the NVD entry and Microsoft's advisory; Tenable's Patch Tuesday roundup has the full July context. The lesson that keeps repeating this month: the loudest CVE isn't always the most dangerous one to you. An unauthenticated RCE on infrastructure you run — SharePoint, DHCP, PeopleSoft — deserves the same urgency whether or not it's trending.
