CVE-2026-62812

Windows DHCP Server Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 28th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile28th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-09-02Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your organization uses Windows DHCP Server (DHCP role enabled) on any of: Windows 10, Windows Server 2012/2012 R2, 2016, 2019, 2022, or 2025.
On each affected Windows system, verify the installed Windows build/patch level.
Upgrade/patch to the fixed versions: Windows 10 (10.0.14393.9418 or 10.0.17763.9121), Windows Server 2012 (6.2.9200.26280), Windows Server 2012 R2 (6.3.9600.23338), Windows Server 2016 (10.0.14393.9418), Windows Server 2019 (10.0.17763.9121), Windows Server 2022 (10.0.20348.5499), Windows Server 2025 (10.0.26100.33296).
If you cannot patch immediately, restrict local access to DHCP servers so only trusted admins can log on, and reduce any low-privilege local access paths (because this requires low privileges already).

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

This is a Windows DHCP Server bug that lets an authorized person with low permissions locally gain much higher access; if your small business doesn’t run DHCP, you likely won’t be affected, but if you do, you should patch.

CVE-2026-62812 is a local privilege escalation in Windows DHCP Server where the service can follow symbolic links or shortcuts improperly before file access, letting an authorized low-privileged attacker elevate privileges.

If you're affected

Full device takeover
Admin-level control of DHCP
Service disruption
Wider network compromise

What is it

Windows DHCP Server is the service that hands out IP settings to computers on your network. This vulnerability is like a door that can be tricked into opening the wrong way when the attacker is already allowed onto the machine with low permissions, letting them push their privileges much higher.

Who is affected

This matters if you run the Windows DHCP Server role on any of the affected systems: Windows 10 or Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025). The key risk is that an authorized attacker with low-level access can try this locally, without needing any special user actions. Reachability is effectively gated by local access: it’s only a risk if someone already has low privileges on the device running DHCP Server.

How urgent is it

This is RED because it enables local privilege escalation on DHCP servers, and patching is the direct mitigation. Even though no incidents are specifically linked to this CVE in the provided reporting and no public exploit code is recorded, we still treat it as urgent for DHCP servers because once an attacker has low access on a machine, they can try to escalate. Prioritize patching on systems that actually run DHCP Server.

What to do — in detail

Confirm exposure (what to check):
- Identify which servers (and whether any client machines) have the Windows DHCP Server role installed and active.
- For each such machine, record its OS version and current Windows build/patch level.
Determine whether you’re on a vulnerable version:
- Compare your current build/patch level against the fixed versions below.
Upgrade to the fixed version (exact targets):
- Windows 10: fixed in 10.0.14393.9418 OR 10.0.17763.9121.
- Windows Server 2012: fixed in 6.2.9200.26280.
- Windows Server 2012 R2: fixed in 6.3.9600.23338.
- Windows Server 2016: fixed in 10.0.14393.9418.
- Windows Server 2019: fixed in 10.0.17763.9121.
- Windows Server 2022: fixed in 10.0.20348.5499.
- Windows Server 2025: fixed in 10.0.26100.33296.
Patch method:
- Apply the relevant Windows updates until the machine reaches (or exceeds) the fixed build for your OS.
- After patching, reboot if your update process requires it, and then verify the build number again.
Workaround if patching is delayed:
- Reduce the chance of “authorized low-privilege local access” by tightening who can log on locally to DHCP servers.
- Remove unnecessary local accounts and disable unused accounts/roles that could provide low privileges.
- Restrict physical/interactive access and remote admin access methods to trusted administrators.
What to monitor after remediation:
- Look for unusual local logon patterns and privilege changes on DHCP servers (because this issue requires local access with low privileges as a starting point).
- Confirm DHCP service health and normal IP lease behavior after updates.

Technical context

Severity and type: This is a privilege escalation (CWE-59) in Windows DHCP Server. The mechanism is improper link resolution before file access, where the service may follow symbolic links or shortcuts incorrectly, allowing an authorized low-privileged local attacker to elevate privileges.

Exploitation status: No KEV listing was provided, and the provided news/press finding did not report dated exploitation or related incidents for this specific CVE. No public exploit code is listed.

Impact model: The provided traffic-light decision is RED, reflecting the high consequence if an attacker already has low privileges on the DHCP server (the attack is local and does not require user interaction).

Fix: The remediation is available via specific fixed Windows builds per OS version as listed in the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS28th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 28th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

13 events over 22 days, from the signal feeds we watch.

2026-09-02Patch availablerecord updated
2026-08-17Patch availablerecord updated
2026-08-16Record updated
2026-08-13OpenVAS check added
2026-08-12Record updatedrecord updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 11 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable