Recheck the network exposure on any open CVE-2026-44815 ticket. Microsoft’s November revision points to clients that can receive a reply from an untrusted DHCP server on an adjacent network.
What changed · November 10, 2026
Microsoft published CVE-2026-44815 on June 9. Revision 1.1 changes the impact from remote code execution to adjacent-network elevation of privilege, the MSRC severity from Critical to Important and CVSS 3.1 from 9.8 to 8.8. Microsoft labels the revision informational. The June fixed builds still apply. The vendor FAQ identifies the Windows DHCP client receiving a reply from an attacker-controlled DHCP server. MSRC reports no known exploitation or public disclosure and assesses exploitation Less Likely. The CVE was absent from CISA KEV on November 11.
Affected Windows branches and June fix floors
Microsoft’s CNA lists affected builds from the branch’s base build (.0) up to, but excluding, the fixed build below. Use the applicable supported servicing channel, including ESU where required. A later superseding cumulative update also covers the fix.
| Product | First fixed build | KB |
|---|---|---|
| Windows 10 1607 and Server 2016 | 14393.9234 | KB5094122 |
| Windows 10 1809 and Server 2019 | 17763.8880 | KB5094123 |
| Windows 10 21H2 and 22H2 | 19044.7417 / 19045.7417 | KB5094127 |
| Windows 11 23H2 | 22631.7219 | KB5093998 |
| Windows 11 24H2 and 25H2 | 26100.8655 / 26200.8655 | KB5094126 |
| Windows 11 26H1 | 28000.2269 | KB5095051 |
| Windows Server 2022 | 20348.5256 | KB5094128 |
| Windows Server 2025 | 26100.32995 | KB5094125 |
| Windows Server 2012 and 2012 R2 | 9200.26132 / 9600.23228 | KB5094042 / KB5094041 |
Use Microsoft’s product rows for architecture and Server Core applicability. Windows 10 1607 and 1809 are listed on x86 and x64. Windows 10 21H2 and 22H2 are listed on x86, x64 and Arm64. Windows 11 rows are x64 and Arm64. Windows Server rows are x64.
Suggested MSP action
Inventory unpatched Windows clients and servers and identify segments that permit untrusted DHCP replies. Prioritize exposed segments and roaming endpoints. Where supported, restrict DHCP replies to trusted ports and validate DHCP relay, Wi-Fi and PXE behavior before enforcing changes. Roll out the applicable cumulative update through Intune, Windows Update or your patch platform, then verify OS build and DHCP lease renewal. Investigate unexpected DHCP offers where observed. Microsoft lists no workaround in the reviewed CVRF.
Last verified November 11, 2026.
Official sources
MSRC CVE-2026-44815 · June MSRC CVRF revision and KB matrix · Microsoft CNA record · CISA KEV data