CVE-2026-62755

Windows DHCP Client Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether any affected Windows versions are installed and currently unpatched (especially machines with users who could gain low-level local access).
For Windows 10, update to one of the fixed builds: 10.0.14393.9418, 10.0.17763.9121, 10.0.19044.7663, or 10.0.19045.7663.
For Windows 11, update to one of the fixed builds: 10.0.22631.7517, 10.0.26100.9168, 10.0.26200.9168, or 10.0.28000.2704.
For Windows Server, update to one of the fixed builds: 6.2.9200.26280 (2012), 6.3.9600.23338 (2012 R2), 10.0.14393.9418 (2016), 10.0.17763.9121 (2019).
If you cannot patch immediately, restrict who can obtain local access to those machines (limit local logons/admin rights) until updates are applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Stack-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

This is a Windows bug where a person who already has basic access to your PC can use the DHCP client to crash it and end up with full administrator control, so it’s important for you to patch quickly if you have Windows devices in use.

CVE-2026-62755 is a local elevation-of-privilege flaw (CWE-121) in the Windows DHCP Client where sending overly long network configuration data can crash or malfunction the component and grant the attacker complete control as an administrator.

If you're affected

Full administrator takeover
Complete data theft risk
System disruption and outages
Malware installation as admin

What is it

Windows’ DHCP client is the part of Windows that helps get network settings automatically. This bug lets someone with basic local access send in bad (overly long) data so the component misbehaves in a way that can hand them full administrator power over the machine, meaning they could read files, change settings, and install software.

Who is affected

This matters to you if you run or manage any of these Windows versions on computers or servers: Windows 10, Windows 11, and the listed Windows Server releases. It’s a local privilege escalation issue, meaning it requires an attacker to already have low-level local access on the machine (and no user interaction is needed once they’re there). Only consider it a risk if a bad actor can get local foothold (for example, through a compromised account, insider access, or another local compromise).

How urgent is it

Verdict is RED because the flaw can turn basic local access into complete administrator control, which can lead to full compromise of your systems. There’s no public evidence in the findings that it’s being exploited in the wild for this specific CVE, but patching is still urgent due to the impact and the attacker technique pattern noted in reporting.

What to do — in detail

Confirm exposure

Inventory your devices running any of these affected products: Windows 10, Windows 11, and the listed Windows Server versions.
On each device, check the OS build number and compare it to the fixed builds below. If the build is not at/above a fixed build for your release, you should treat the device as vulnerable.

Upgrade to a fixed build

Patch to the exact fixed versions Microsoft lists for your platform:

Windows 10: 10.0.14393.9418 OR 10.0.17763.9121 OR 10.0.19044.7663 OR 10.0.19045.7663
Windows 11: 10.0.22631.7517 OR 10.0.26100.9168 OR 10.0.26200.9168 OR 10.0.28000.2704
Windows Server 2012: 6.2.9200.26280
Windows Server 2012 R2: 6.3.9600.23338
Windows Server 2016: 10.0.14393.9418
Windows Server 2019: 10.0.17763.9121

(Use Microsoft’s update guidance page for the exact update packages for your device.)

If patching is delayed (temporary containment)

Reduce the chance someone can gain low-level local access: tighten local account policies, remove unnecessary local accounts, and restrict who can log on interactively.
Review recent additions to local admin groups and remove unauthorized changes.
Monitor for unusual local activity on endpoints (especially any new accounts or suspicious program installs) until patches are applied.

What to monitor after patching

Confirm the update installed successfully and the build number changed to a fixed one.
Continue to watch for signs of local compromise (new services, unexpected software installs, and changes to security-relevant settings).

KEV / exploitation timing

KEV is not listed in the CISA KEV feed for this CVE in the provided findings.
The provided press findings do not state clear, dated exploitation of this specific CVE.
Even without confirmed widespread exploitation, this is still high risk due to full administrator takeover potential once an attacker has local access.

Technical context

CVE-2026-62755 is a Windows local elevation of privilege issue (CWE-121) affecting the DHCP Client. The mechanism described in the findings is that an attacker with low-level local access can send overly long data to the network configuration tool used for IP address assignment, causing the component to crash or malfunction in a way that grants full control over the machine. The attack does not require user interaction.

Severity is high (given by the provided CVSS 7.8) with the core risk being complete compromise (confidentiality, integrity, and availability impact) after local access is gained. There is no public exploit code on record in the findings, and no specific KEV listing was provided. Press reporting in the findings does not attribute exploitation to this CVE, and no incidents are reported; however, traffic indicates patch-focused attention and actor interest (Lazarus group) in the reporting summary.

EPSS is provided as a prediction in the findings, but public EPSS figures are not used as the basis for urgency when exploitation confirmation is available; in this case, KEV/news do not confirm exploitation of this exact CVE in the provided findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updatedrecord updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable