Windows DHCP Server EUVD-2026-56672

Exploitation requires an authenticated local user account (PR:L per CVSS vector) with the ability to create symbolic links or NTFS junction points on the target file system - a capability available by default to standard Windows users unless restricted by policy (e.g., SeCreateSymbolicLinkPrivilege is sometimes restricted). The Windows DHCP Server service must be installed and running on the target host. No network-based initial access is required; the attacker must already have a local session (interactive, RDP, or service context) on the DHCP server host. No user interaction or special non-default configuration is needed beyond the DHCP role being active. Exploitation is limited to the local system (S:U, no lateral scope change) and does not enable remote code execution against other hosts directly.

The CVSS 3.1 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a high-confidence, low-friction local escalation. Attack complexity is Low, meaning the symlink/junction technique is reliable and does not require race condition timing precision beyond what standard tooling provides. PR:L confirms that any authenticated local or service account suffices - no administrator access needed to trigger the vulnerable code path. The full C:H/I:H/A:H triad indicates an attacker can read, modify, or destroy SYSTEM-owned files once exploitation succeeds, enabling full SYSTEM-level compromise. No CISA KEV listing has been identified, and no POC code has been confirmed publicly, which moderates urgency compared to a KEV-listed flaw. However, symlink-based LPE primitives on Windows are well-understood by the offensive community, meaning weaponization from a motivated attacker with local access is not a significant technical barrier. The 'Information Disclosure' tag alongside the privilege escalation description suggests that file read capability via link following may be the primary initial impact, with write-based escalation as a secondary technique. EPSS data was not provided; risk should be weighted primarily by CVSS signal and prevalence of DHCP Server in enterprise Active Directory environments.

An attacker with a low-privileged domain or local user account on a Windows Server running the DHCP Server role creates a symbolic link or NTFS junction in a writable directory, redirecting it to a privileged system file path such as a SAM database backup or a SYSTEM-owned executable. When the DHCP Server service performs its routine file operation (log write, lease database update, or config read) and resolves the redirected path, it reads from or writes to the privileged target with SYSTEM credentials, allowing the attacker to overwrite sensitive executables or extract credential material. No public POC has been confirmed, but this class of Windows symlink LPE is well-documented in offensive toolkits.