Windows DHCP Server CVE-2026-83787

Exploitation requires the target host to be running the Windows DHCP Server role (not present by default on client or non-DHCP servers), and the attacker must already possess low-level authenticated access with local access to that host (AV:L/PR:L) - this is not remotely or unauthenticated-exploitable. No user interaction is needed (UI:N). The primary limiting factors are the need for existing local privileges and the presence of the DHCP Server role; unpatched builds below the fixed versions (e.g., Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761, Server 2019/Win10 1809 <10.0.17763.9376) are required for exploitation.

This is a genuinely moderate-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) is internally consistent with the description: local attack vector, low attack complexity, and low privileges required, producing only an integrity impact (security-feature bypass) with no confidentiality or availability loss. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation-probability and automatability cannot be assessed - this must be treated as a data gap, not as evidence of low risk. The CWE-288 (authentication/security-feature bypass) classification aligns with the 'insufficient verification of data authenticity' description and the I:H-only impact. Because the vector requires both local access (AV:L) and existing privileges (PR:L), this is not a remotely weaponizable flaw; the realistic concern is a foothold-holding attacker on or adjacent to a Windows DHCP Server escalating capability by bypassing a security control. There are no conflicting signals between CVSS and the description - both point to an authenticated, local, integrity-only weakness - so the medium severity appears accurate.

An attacker who already has low-privileged authenticated access to a host running the Windows DHCP Server role locally supplies crafted data that the server fails to properly verify for authenticity, bypassing a security feature to achieve an unauthorized integrity change. No public exploit was identified at the time of analysis, and the local vector plus required privileges mean this would be used as a post-compromise step rather than an initial intrusion.