CVE-2026-62761

Windows DHCP Server Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 28th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile28th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-09-02Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-62761 is a Windows DHCP Server flaw that lets a low-privilege attacker who can log onto the machine gain full control; it’s a serious issue for organizations running Windows DHCP Server, but only if the attacker can get local access.

CVE-2026-62761 is a local elevation of privilege in Windows DHCP Server where improper link resolution (“link following”) during file handling allows a low-privileged authenticated local attacker to gain full control of the system.

If you're affected

Full system takeover
Control of network services
Data theft risk
Backup and operations disruption

What is it

This is a bug in Windows DHCP Server that mishandles file links. If someone can already get low-level local access to the computer, they may be able to use that bug to jump to full control—like moving from “employee access” to “building owner” without permission.

Who is affected

This matters if you run Windows DHCP Server on any of the listed systems (windows 10 or the listed Windows Server versions). The vulnerability is local and requires an authenticated attacker with local access, so it’s mainly a concern for machines that could be reached by someone who can log onto them. The practical risk is: only if an attacker can get authenticated local access to a machine running the Windows DHCP Server component.

How urgent is it

This is urgent because the flaw is designed to turn low-privilege local access into full control, and it’s reachable in a default setup for the DHCP Server component. Even though there’s no confirmed publicly described exploitation in the provided materials, the recommended posture for a RED verdict is to patch immediately on any DHCP servers you operate.

What to do — in detail

Identify exposure

Determine which computers in your business run the Windows DHCP Server component (DHCP role/service). Focus on machines running windows 10 and the listed Windows Server versions.

Confirm whether each machine is on the vulnerable branch

For each DHCP server, check the exact Windows build/version.
Compare against the fixed versions Microsoft lists for CVE-2026-62761:
- windows 10: fixed in 10.0.14393.9418 or 10.0.17763.9121
- windows server 2012: fixed in 6.2.9200.26280
- windows server 2012 r2: fixed in 6.3.9600.23338
- windows server 2016: fixed in 10.0.14393.9418
- windows server 2019: fixed in 10.0.17763.9121
- windows server 2022: fixed in 10.0.20348.5499
- windows server 2025: fixed in 10.0.26100.33296

Patch

Install the Microsoft update referenced by the CVE on the Microsoft Update Guide page.
Restart as required by the update procedure and verify the build now matches (or exceeds) the fixed version for your specific OS branch.

Temporary workaround (if you must wait)

Because exploitation requires authenticated local access, reduce the chance of someone gaining that access:
- Remove unnecessary local admin rights.
- Restrict local logon/interactive access paths (for example, tighten console/RDP/remote management access to approved personnel only).
- Review and disable unused accounts, especially accounts with the ability to authenticate locally.

What to monitor after patching

Confirm DHCP Server service status and normal operations.
Review security logs for unexpected local logons on DHCP servers and for any anomalous admin activity around the time of patching.

Technical context

Severity is high (CVSS 7.8) with a local attack model and low privileges required for the attacker, and no user interaction is needed. The weakness is CWE-59 (improper link resolution / link following). In this case, the vulnerable Windows DHCP Server component performs file/link handling in a way that can be abused by an authenticated local attacker with low privileges to escalate to full control.

KEV: not listed in the CISA KEV set based on the provided findings. Public exploit code: none on record in the provided materials. Exploitation maturity: no specific dated incidents were provided, but exploitation is still treated as a priority due to the RED verdict and the fact that the vulnerable component is reachable in default configuration.

Patch availability: fixed versions are available per Windows branch on Microsoft’s update guide for CVE-2026-62761. EPSS is provided as a prediction (not a claim of active exploitation); no KEV or dated exploitation confirmation was included in the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS28th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 28th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

13 events over 22 days, from the signal feeds we watch.

2026-09-02Patch availablerecord updated
2026-08-17Patch availablerecord updated
2026-08-16Record updated
2026-08-13OpenVAS check added
2026-08-12Record updatedrecord updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 11 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable