Windows DHCP Server CVE-2026-62776

Exploitation requires: (1) the Windows DHCP Server role must be installed and running on the target machine - this is not enabled by default on standard Windows installations and is typically present only on designated network infrastructure servers; (2) the attacker must have an authenticated local session with at least low-privilege (PR:L) user rights on that server - remote unauthenticated exploitation is not possible per the AV:L vector; (3) the attacker must be able to create symbolic links or directory junctions in a file path accessible to the DHCP service, which on modern Windows requires the SeCreateSymbolicLinkPrivilege (granted by default to local admins, and in some configurations to standard users). What limits exploitation: the attack is strictly local (AV:L), requires a pre-existing authenticated session, targets a non-default server role, and may require SeCreateSymbolicLinkPrivilege depending on OS configuration. Standard workstations without the DHCP Server role are not affected.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) accurately reflects a local, low-complexity, low-privilege attack with full CIA impact - consistent with a symlink race that requires only a standard user session on a machine running the DHCP Server role. EPSS data is not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified; exploitation status is no public exploit identified at time of analysis. The absence of KEV listing and POC reduces urgency compared to a remotely exploitable flaw, but the attack complexity is genuinely low once an attacker has local access, meaning any environment where untrusted users log in to DHCP servers - even a mid-sized municipal IT team in radom managing their own server estate - should treat this as an urgent patch given the full privilege escalation impact. The tags include 'Information Disclosure,' which partially conflicts with the description's focus on privilege escalation; this discrepancy should be verified against the Microsoft Security Response Center advisory, as the actual impact scope may be broader than the tags suggest.

An attacker with a standard local user session on a Windows Server running the DHCP Server role plants a directory junction or NTFS symlink in a location the DHCP service writes to during normal operation (e.g., audit log directory or lease database path). When the DHCP service - running as SYSTEM - next performs a file operation and follows the attacker-controlled link, it writes to a privileged system path (such as a Windows system binary or registry hive export), allowing the attacker to overwrite a sensitive file and escalate to SYSTEM. No public proof-of-concept code is known at time of analysis, but the technique is well-documented for CWE-59 in the Windows ecosystem.