Windows DHCP Server EUVD-2026-72968

Exploitation requires an attacker who already holds high-privilege access (PR:H) on or to the Windows Server hosting the DHCP Server role - this is not a zero-touch remote exploit. The DHCP Server role must be installed and active (not a default configuration on all Windows Servers). User interaction (UI:R) is required, meaning the attack depends on a privileged user performing some management action or processing a crafted request during the attack window. Limiting factors: attackers without pre-existing elevated credentials cannot directly exploit this; DHCP Server must be explicitly deployed and reachable on the network; patched builds are immune. The attack surface is restricted to environments running the DHCP Server role, which is primarily enterprise AD-joined Windows Server deployments.

The CVSS 3.1 score of 6.8 (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) reflects a nuanced threat profile: network reachability and low complexity inflate risk, but the PR:H (requires existing high-privilege foothold) and UI:R (some user interaction required) substantially limit the attacker pool. This is not an opportunistic internet-facing attack; exploitation requires an adversary who already holds elevated administrative credentials or an existing privileged session on the target Windows Server. The combination of PR:H and UI:R suggests the attack may require a privileged user to perform an action (e.g., open a management tool or handle a crafted request) while connected to the DHCP service. Full C:H/I:H/A:H impact indicates that successful exploitation yields complete compromise of the DHCP server process - potentially disrupting IP address allocation across the network segment. No EPSS data or KEV listing is present in the input, meaning no confirmed active exploitation or widespread scanning is documented. Exploitation probability should be treated as moderate-to-low given the high privilege prerequisite, but the lateral-movement potential (DHCP control = network infrastructure control) elevates organizational risk for defenders managing large Windows environments.

An attacker who has already obtained a privileged Windows domain or local account with access to the DHCP server's management interface crafts or replays a specially formed management request targeting the unauthenticated critical function. By inducing a legitimate high-privilege user to trigger a specific management operation (satisfying the UI:R requirement), the attacker's request bypasses the missing authentication check, executing code or commands with elevated DHCP server process privileges - potentially enabling manipulation of all IP lease assignments or further lateral movement across the network. No public exploit code has been identified at time of analysis.