Windows DHCP Server CVE-2026-62812

Exploitation requires an authorized, low-privileged local account on the target Windows Server host (PR:L per CVSS vector). The DHCP Server service must be installed and running on that host - it is a role that must be explicitly added via Server Manager or PowerShell, so exploitation is limited to servers where this role is deployed, not all Windows Server instances by default. Attack vector is strictly local (AV:L); remote exploitation is not applicable. No user interaction is required (UI:N). The limiting factors are: the attacker must already have authenticated local access to the server, and the target server must be configured with the DHCP Server role. Systems that have removed the DHCP Server role or that enforce strict local logon restrictions are not exposed.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the real-world risk profile: exploitation requires local, low-privileged access with no user interaction and no special attack complexity, yielding full confidentiality, integrity, and availability impact on the vulnerable system. The absence of a CISA KEV listing and no reported public exploit code moderates urgency for internet-facing perimeter systems, but the local-access requirement means any environment where untrusted or semi-trusted users share a Windows Server host running the DHCP role - such as shared administrative jump hosts, multi-tenant management servers, or contractor access scenarios - faces meaningful risk. Even a small municipal IT department running an unpatched Windows Server 2019 DHCP node should treat this as a high-priority patch-cycle item given the trivial complexity (AC:L) and high impact once local access exists. EPSS data was not provided in source intelligence; risk priority should therefore be calibrated primarily on CVSS local-access factors and the breadth of affected Windows Server versions rather than statistical exploitation probability.

A low-privileged domain user or local account holder on a Windows Server hosting the DHCP Server role creates a malicious symbolic link in a directory writable by their account, pointing to a sensitive system file. When the DHCP Server service - running with high privileges - performs a routine file operation and follows the attacker-planted symlink, the service writes to or modifies the targeted privileged file path, enabling the attacker to escalate to SYSTEM-level access. No public proof-of-concept has been identified at time of analysis, but the AC:L rating indicates the technique requires no special preconditions beyond local access.