Windows DHCP Server CVE-2026-62803

Exploitation requires: (1) an authenticated local user account on the target host - PR:L in the CVSS vector confirms low but non-zero privilege is required; unauthenticated remote exploitation is not possible per AV:L; (2) the Windows DHCP Server role must be installed and running on the target system - this is a server role not present by default on workstations, limiting exposure to machines explicitly configured as DHCP servers; (3) the attacker must be able to create a symbolic link or junction in a directory accessible to their account that the DHCP service accesses - standard Users can create symlinks on Windows if the 'Create symbolic links' privilege is granted (SeCreateSymbolicLinkPrivilege), which is not default for non-admin users; this is a meaningful limiting factor. Exploitation is constrained to local access (AV:L), preventing direct internet exploitation. Windows 10 1607 and 1809 are listed as affected, which is notable - DHCP Server on a workstation OS is a non-default, unusual configuration that significantly limits real-world exposure on those platforms.

The CVSS 7.8 score is grounded in a concrete and well-understood attack class: link following by a privileged service. The AV:L vector confirms the attack is local, which substantially limits the internet-facing exposure surface compared to network-exploitable flaws. However, PR:L means any low-privileged domain or local user account suffices - no elevated credentials are needed to set up the symlink. AC:L indicates no race condition or special timing is required, making the exploit reliably reproducible. The full C:H/I:H/A:H triad indicates complete system compromise upon success, consistent with escalation to SYSTEM-level access through a service account. No EPSS score was provided, no KEV listing exists, and no public POC has been identified, which together suggest exploitation is not yet widespread. The primary risk is insider threat or post-initial-access privilege escalation: an attacker who has obtained a low-privilege shell (via phishing, credential stuffing, etc.) on a Windows Server running DHCP could use this to fully own the host. The tag 'Information Disclosure' in the source data conflicts with the description's 'elevate privileges' characterization - the CVSS C:H/I:H/A:H and AV:L/PR:L vector are consistent with privilege escalation, not mere information disclosure; defenders should treat this as a full EoP vulnerability.

An attacker who has already obtained a low-privileged local account on a Windows Server running the DHCP Server role creates a symbolic link or directory junction pointing from a path the DHCP service writes to toward a sensitive system file or directory (such as a privileged executable or registry hive export location). When the DHCP service performs its normal file operation and follows the attacker-controlled link without validation, the write or operation executes under the service's elevated context, allowing the attacker to overwrite or plant content that yields SYSTEM-level code execution. No public proof-of-concept has been identified at time of analysis, but the AC:L rating indicates the technique requires no special timing or precondition beyond the symlink setup.