Windows DHCP Server CVE-2026-62761

Exploitation requires an existing low-privileged local account on the target Windows Server host (CVSS PR:L confirmed). The Windows DHCP Server role must be installed and running - this is not a default role on general-purpose Windows Server deployments; it is explicitly configured by administrators. The attacker must be able to create symbolic links, junctions, or hard links within a file path accessible to the DHCP Server service process. Exploitation is local-only (AV:L); no network-facing attack path exists. What limits exploitation: the attacker must have local interactive or programmatic access (ruling out purely remote unauthenticated attackers), and the DHCP Server role must be present (reducing the affected population to dedicated DHCP infrastructure hosts). No user interaction is required once the link is in place (UI:N).

CVSS 7.8 with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a reliable, low-complexity local escalation with full impact - a strong indicator of real-world exploitability once local access exists. The local attack vector (AV:L) inherently limits exposure compared to network-facing vulnerabilities: an attacker must already hold a low-privileged interactive or service account on the target host. No public exploit code exists and the vulnerability is absent from CISA KEV, so mass automated exploitation is not currently a concern. However, link-following vulnerabilities in Windows privileged services have a well-established exploitation history (e.g., Task Scheduler, Print Spooler) and tend to be weaponized quickly once details emerge. The tags list 'Information Disclosure' which conflicts with the description's stated impact of privilege escalation and the CVSS C:H/I:H/A:H metrics - the true impact appears to be full EoP, not merely information disclosure; defenders should treat this as a privilege escalation priority. EPSS data was not provided in the source intelligence.

An attacker who has obtained a low-privileged local account on a Windows Server running the DHCP Server role creates a malicious NTFS junction or symbolic link in a directory path that the DHCP Server service accesses during normal operation. When the DHCP service performs a privileged file write or read through that path, it follows the attacker's link and operates on an arbitrary target location (such as a system binary or registry hive) as SYSTEM, enabling the attacker to overwrite a privileged file, plant a payload, or read sensitive credentials. No public proof-of-concept code has been identified, but the technique is well-understood in the Windows local privilege escalation ecosystem.