What is the CVSS score of EUVD-2026-56656?

EUVD-2026-56656 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Windows DHCP Server are affected by EUVD-2026-56656?

Windows DHCP Server (versions 2012-2025) is vulnerable to local privilege escalation (CVE-2026-62761) that allows authenticated users with low-level access to gain full SYSTEM permissions.. A patch is available.

How to fix or mitigate EUVD-2026-56656?

Within 24 hours, complete an inventory of all Windows DHCP servers running Server 2012-2025 and consult the vendor advisory for patch availability by version. Within 7 days, develop a staged patching plan prioritized by server criticality and begin deployment in non-production environments to validate compatibility and DHCP service functionality. Within 30 days, complete patching of all production DHCP servers and confirm all systems have been rebooted to activate the security update.

Windows DHCP Server EUVD-2026-56656

| CVE-2026-62761 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-08-11 secure@microsoft.com

GHSA-j33j-mjh4-r8m9

Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and low-privilege requirement confirmed by link-following class; full C/I/A impact reflects SYSTEM-level file access achievable via symlink redirection.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:54 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows DHCP Server exploits improper symbolic link resolution (CWE-59), allowing a low-privileged authenticated local user to gain full SYSTEM-level access across a wide range of Windows Server versions from 2012 through 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires no interaction and only low-level local access, making this a practical post-exploitation escalation tool once an attacker has any foothold on a DHCP Server host. No public exploit code or CISA KEV listing has been identified at time of analysis, though a vendor patch is available.

Technical ContextAI

CWE-59 (Improper Link Resolution Before File Access, also known as 'link following') describes a class of vulnerabilities where a privileged process resolves a symbolic link, junction, or hard link provided or influenced by a lower-privileged user before performing a sensitive file operation. The Windows DHCP Server service (dhcpssvc.dll/dhcpserver.exe) runs under SYSTEM privileges. When it accesses a file path that a low-privileged local user can influence - for example via a directory in a writable location, a mount point, or an NTFS junction - the service follows the attacker-controlled link and operates on an arbitrary target path as SYSTEM. Affected CPE targets span Windows Server 2012 (6.2.9200.x), 2012 R2 (6.3.9600.x), 2016 (10.0.14393.x), 2019 (10.0.17763.x), 2022 (10.0.20348.x), and 2025 (10.0.26100.x), as well as Windows 10 versions 1607 and 1809 where the DHCP Server role can be installed.

RemediationAI

Apply the Microsoft security update corresponding to the installed Windows Server version: update to 6.2.9200.26279 or later (Server 2012), 6.3.9600.23337 or later (Server 2012 R2), 10.0.14393.9418 or later (Server 2016 / Windows 10 1607), 10.0.17763.9115 or later (Server 2019 / Windows 10 1809), 10.0.20348.5499 or later (Server 2022), or 10.0.26100.33296 or later (Server 2025). Patches are available via Windows Update and the Microsoft Update Catalog; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62761 for the specific KB article per version. Where immediate patching is not feasible, reduce risk by strictly limiting local logon rights on DHCP Server hosts to only necessary administrative accounts, removing interactive logon for service accounts, and auditing symbolic link creation (SeCreateSymbolicLinkPrivilege) - note that restricting this privilege may affect legitimate applications. Disabling the DHCP Server role on hosts where it is not operationally required eliminates the attack surface entirely.