Vulnerability report

CVE-2026-54128

Windows DHCP Client Remote Code Execution Vulnerability

Microsoft / Windows 10 Version 1607 · affected before 10.0.14393.9339

Watch CVE-2026-54128 Browse KEV feed
Severity
CVSS 8.4 · High
Confidence
—
Exploit status
—
EPSS
—
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-54128 is an unauthenticated Windows DHCP Client Remote Code Execution Vulnerability affecting Microsoft Windows 10 Version 1607 and 17 other products. Use after free in Windows DHCP Client allows an...

Have exploitation attempts been observed?

No. Previdian has not recorded exploitation attempts for this vulnerability yet.

Who is affected?

Microsoft / Windows 10 Version 1607 affected before 10.0.14393.9339.

What should we do?

Track for updates. Assess relevance to your asset inventory and enrichment workflows.

Overview

Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally

Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally.

Microsoft Affected
Windows 10 Version 1607
Before 10.0.14393.9339
Microsoft Affected
Windows 10 Version 1809
Before 10.0.17763.9020
Microsoft Affected
Windows 10 Version 21H2
Before 10.0.19044.7548
Microsoft Affected
Windows 10 Version 22H2
Before 10.0.19045.7548
Microsoft Affected
Windows 11 Version 24H2
Before 10.0.26100.8875
Microsoft Affected
Windows 11 Version 25H2
Before 10.0.26200.8875
Microsoft Affected
Windows 11 version 26H1
Before 10.0.28000.2525
Microsoft Affected
Windows Server 2012
Before 6.2.9200.26226
Microsoft Affected
Windows Server 2012 (Server Core installation)
Before 6.2.9200.26226
Microsoft Affected
Windows Server 2012 R2
Before 6.3.9600.23291
Microsoft Affected
Windows Server 2012 R2 (Server Core installation)
Before 6.3.9600.23291
Microsoft Affected
Windows Server 2016
Before 10.0.14393.9339
Microsoft Affected
Windows Server 2016 (Server Core installation)
Before 10.0.14393.9339
Microsoft Affected
Windows Server 2019
Before 10.0.17763.9020
Microsoft Affected
Windows Server 2019 (Server Core installation)
Before 10.0.17763.9020
Microsoft Affected
Windows Server 2022
Before 10.0.20348.5386
Microsoft Affected
Windows Server 2025
Before 10.0.26100.33158
Microsoft Affected
Windows Server 2025 (Server Core installation)
Before 10.0.26100.33158
View vendor advisory (opens in new tab)
Published
14 Jul 2026
Exploitation date
—
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None

Tags

windows microsoft

CVE References

Exploitation evidence

Exploitation evidence for this CVE

Catalogues and sources that list this CVE as a known exploited vulnerability, when available.

No exploitation evidence rows are recorded for this CVE yet.

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.4 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS

—

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Use After Free CWE-416

Recent mention · Rapid7

Patch Tuesday - July 2026

Microsoft is publishing 622 vulnerabilities on July 2026 Patch Tuesday, including a record-breaking 416 Windows vulnerabilities. Microsoft is aware of exploitation in the wild for two of the vulnerabilities published today, both of which are listed on CISA KEV, as well as...

Read full advisory

All Mentions

Recent mention · Rapid7

Patch Tuesday - July 2026

Rapid7 · 14 Jul 2026

Microsoft is publishing 622 vulnerabilities on July 2026 Patch Tuesday, including a record-breaking 416 Windows vulnerabilities. Microsoft is aware of exploitation in the wild for two of the vulnerabilities published today, both of which are listed on CISA KEV, as well as public disclosure for one other. As usual, browser vulns are not included in the Patch Tuesday count above. Rapid7 noted last month that Microsoft no longer enumerates Chromium CVEs in the Security Update Guide. However, Microsoft has now taken the pursuit of minimalism much further, since today’s Security Update Guide no...

Recent mention · Tenable Blog

Microsoft’s July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)

Tenable Blog · 14 Jul 2026

56Critical510Important3Moderate0LowMicrosoft addresses 569 CVEs in the largest Patch Tuesday release yet. This month’s release includes three zero-days, two of which were exploited in the wild.Microsoft patched 569 CVEs in its July 2026 Patch Tuesday release, with 56 rated critical, 510 rated as important, and 3 rated as moderate. This marks the largest Patch Tuesday release ever, crushing the previous record of 198 CVEs in June. Last week, Microsoft announced that its multi-model agentic scanning harness (MDASH) is being used to identify vulnerabilities faster and noted that “customers...

Timeline

From disclosure to today

  1. 17:08 UTC

    CVE published

    Vulnerability disclosed publicly

  2. 20:33 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-54128

Sample API response 
{
  "cve_id": "CVE-2026-54128",
  "confidence": null,
  "cvss_score": 8.4,
  "cvss_estimated": false,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": false,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}