Windows DHCP Server EUVD-2026-35562

The attacker must have network-layer reachability to a Windows Server host with the DHCP Server role enabled and listening, typically on UDP ports 67/68 within a routed enterprise network, VPN segment, or any environment where DHCP traffic is forwarded. No authentication, no user interaction, and no special non-default configuration are indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N) - any reachable, role-enabled DHCP server is in scope. Limiting factors: the DHCP Server role is not installed by default on Windows Server and is typically deployed only on domain controllers or dedicated infrastructure hosts, and DHCP traffic is rarely exposed to the public internet, so realistic exploitation requires an attacker already inside the network perimeter or on a segment with routed access to the DHCP service.

Signals broadly align toward elevated priority: CVSS 9.1 with AV:N/AC:L/PR:N/UI:N indicates a remote, low-complexity, unauthenticated path, and confidentiality and integrity impacts are both High while availability is None - consistent with a tampering rather than denial-of-service primitive. The 'Authentication Bypass' tag reinforces the PR:N reading. However, no EPSS score, KEV listing, SSVC decision, or POC indicator was provided in the input, so real-world exploitation probability cannot be quantified from this data alone, and there is no public exploit identified at time of analysis. Given DHCP's central role in enterprise networks and that the only reference is the Microsoft MSRC advisory (no third-party technical write-up), this should be treated as a high-priority patch candidate while acknowledging that exploitation telemetry is currently unknown.

An attacker with network reachability to the DHCP server - for example, a foothold on any client VLAN that can route UDP to the server - sends crafted DHCP protocol messages that exploit the authentication bypass to modify server-side state such as leases, reservations, or scope options. By tampering with DNS server or default gateway options pushed to clients, the attacker can redirect victim traffic through attacker-controlled infrastructure for credential capture or man-in-the-middle attacks. No public exploit identified at time of analysis, but the low attack complexity and lack of required privileges make weaponization straightforward once internals are understood.