Windows DHCP Server EUVD-2026-73437

Exploitation requires the target system to have the Windows DHCP Server role installed and running, and the attacker must hold a valid low-privileged account with sufficient authorization to interact with the DHCP Server over the network (CVSS PR:L). The description uses the phrase 'authorized attacker,' confirming that unauthenticated exploitation is not possible. Limiting factors: the attacker needs a pre-existing authenticated foothold on the network, the DHCP Server role must be deployed (not a default-on role for all Windows systems), and the specific credential storage path must be populated. No non-default configuration option is cited as the trigger - any DHCP Server deployment within the affected version range appears vulnerable once the role is active.

The CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly captures a network-reachable, low-complexity information disclosure. The C:H rating is significant because recovered passwords - not hashes - can be directly reused in pass-the-password attacks or to authenticate to other services, amplifying the real-world blast radius beyond the CVSS score suggests. However, PR:L is a meaningful constraint: the attacker must already hold a valid low-privilege account, ruling out unauthenticated exploitation. No CISA KEV listing and no public exploit code exist at time of analysis, suggesting no observed in-the-wild abuse. EPSS data was not provided. The breadth of affected versions (Server 2012 through 2025) increases aggregate exposure across enterprise estates that have not patched. Real priority is moderate-to-high for organizations running the DHCP Server role, primarily due to credential-reuse chaining risk.

An attacker with a low-privilege domain or local account queries the Windows DHCP Server over the network and retrieves credentials stored in a recoverable format - for example, the account used by DHCP for dynamic DNS registrations. The attacker decodes or decrypts those credentials without brute-force and reuses them to authenticate to Active Directory or other services, escalating from a low-privilege foothold to broader network access. No public exploit code exists at time of analysis, so exploitation likely requires familiarity with DHCP Server internals.