EUVD-2026-56671
GHSA-6jpx-3jw7-m427
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack via symlink requires existing low-privilege session; DHCP service context yields full system impact with no user interaction.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Windows DHCP Server exploits improper symbolic link resolution (CWE-59), allowing an authenticated local attacker with low privileges to fully compromise system confidentiality, integrity, and availability. The flaw affects Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is active. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and no user interaction requirement make this a credible post-compromise escalation path.
Technical ContextAI
CWE-59 ('Improper Link Resolution Before File Access') describes a class of vulnerabilities where a privileged process follows a symbolic link or junction point crafted by a lower-privileged user before performing a file operation, inadvertently acting on an attacker-controlled path. In this case, Windows DHCP Server - a system-level service typically running as NETWORK SERVICE or SYSTEM - fails to safely resolve link targets prior to file access. Affected products span the entire modern Windows Server lineage: Windows Server 2012 (6.2.9200.x), Server 2012 R2 (6.3.9600.x), Server 2016 (10.0.14393.x), Server 2019 (10.0.17763.x), Server 2022 (10.0.20348.x), and Server 2025 (10.0.26100.x), as confirmed by ENISA EUVD-2026-56671. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U reflects a local, low-complexity exploitation path requiring only a standard user account - consistent with link-following attacks where the attacker creates a junction or symlink in a world-writable directory that the DHCP service subsequently accesses.
RemediationAI
Apply the Microsoft-released patches via Windows Update or WSUS. The fixed builds per ENISA EUVD-2026-56671 are: Windows Server 2025 build 10.0.26100.33296 or later; Windows Server 2022 build 10.0.20348.5499 or later; Windows Server 2019 and Windows 10 1809 build 10.0.17763.9115 or later; Windows Server 2016 and Windows 10 1607 build 10.0.14393.9418 or later; Windows Server 2012 R2 build 6.3.9600.23337 or later; Windows Server 2012 build 6.2.9200.26279 or later. Consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62803 for patch availability per channel. Where immediate patching is not feasible, a compensating control is to restrict the DHCP Server role to only hosts where it is operationally required - removing the role from servers where it is unused eliminates the attack surface entirely. Additionally, limiting interactive and remote logon rights on DHCP servers to a minimal set of administrative accounts reduces the pool of principals who could trigger the symlink chain, though this does not eliminate the vulnerability.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today