EUVD-2026-35562
GHSA-9g25-jr9m-x4jh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
No cwe for this issue in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network.
AnalysisAI
Remote tampering in Microsoft Windows DHCP Server allows unauthenticated network attackers to manipulate critical data with high confidentiality and integrity impact, as reflected by the 9.1 CVSS score. The vulnerability is reachable over the network without privileges or user interaction, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have network-layer reachability to a Windows Server host with the DHCP Server role enabled and listening, typically on UDP ports 67/68 within a routed enterprise network, VPN segment, or any environment where DHCP traffic is forwarded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals broadly align toward elevated priority: CVSS 9.1 with AV:N/AC:L/PR:N/UI:N indicates a remote, low-complexity, unauthenticated path, and confidentiality and integrity impacts are both High while availability is None - consistent with a tampering rather than denial-of-service primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reachability to the DHCP server - for example, a foothold on any client VLAN that can route UDP to the server - sends crafted DHCP protocol messages that exploit the authentication bypass to modify server-side state such as leases, reservations, or scope options. By tampering with DNS server or default gateway options pushed to clients, the attacker can redirect victim traffic through attacker-controlled infrastructure for credential capture or man-in-the-middle attacks. … |
| Remediation | Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45602 to all Windows Server hosts running the DHCP Server role, prioritizing internet-adjacent and multi-tenant environments first. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Windows servers with DHCP Server role enabled and implement firewall ACLs restricting DHCP traffic to authorized management networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today