CVE-2026-62814

DHCP Server is the “automatic address assignment” service that helps devices on your network get the right network settings (like IP address details). This vulnerability lets someone on the same local network trick the DHCP server into revealing private information about the computer that runs it. It doesn’t require a login, so the main protection is keeping the DHCP server fully patched and limiting who can reach it over the local network.

This matters if you run Windows DHCP Server on one of these systems: windows 10, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2025, or windows server 2012 r2. The attacker does not need an account; the risk exists from an adjacent network position on the same local network segment.

Reachability gate: it’s a risk when an attacker can reach the DHCP server from the local network they share (adjacent network access).

Treat this as urgent because the issue is a patch-relevant information disclosure in a network service and does not require authentication. Even though there are no clear, dated public incidents reported for this specific CVE, the update is the correct mitigation and the affected role is commonly reachable from the internal network.

Given the RED verdict, prioritize patching on DHCP servers as part of your next scheduled maintenance window (or sooner if you have a DHCP server exposed to many internal segments).

1. Inventory and confirm exposure

   • Identify which servers/devices are running the DHCP Server role/service.
   • Confirm they are on one of these platforms: windows 10, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2025, windows server 2012 r2.

2. Check the current build/version

   • On each DHCP Server machine, review the installed Windows build/version (your IT admin can do this in system properties or standard OS version reporting tools).
   • Compare the current build to the fixed versions listed below. If your build is not one of the fixed builds, it is likely vulnerable.

3. Upgrade to the fixed version (target versions)

   • windows 10: fixed in 10.0.14393.9418 and 10.0.17763.9115 (also fixed in 10.0.17763.9121)
   • windows server 2012: fixed in 6.2.9200.26280
   • windows server 2012 r2: fixed in 6.3.9600.23338
   • windows server 2016: fixed in 10.0.14393.9418
   • windows server 2019: fixed in 10.0.17763.9115 and 10.0.17763.9121
   • windows server 2022: fixed in 10.0.20348.5440 and 10.0.20348.5499
   • windows server 2025: fixed in 10.0.26100.33222 and 10.0.26100.33296

4. Apply Microsoft’s remediation

   • Use Microsoft’s update guidance for CVE-2026-62814 (see Microsoft Update Guide link from the vendor remediation entry).
   • Follow normal patch procedures for rebooting and DHCP service validation.

5. Temporary risk reduction if patching is delayed

   • Reduce “adjacent network access” to the DHCP server: limit which internal network segments/devices can reach it.
   • Keep DHCP Server tightly segmented (only the networks/subnets that truly need DHCP should be able to communicate with it).

6. After patching

   • Verify the Windows build matches a fixed version listed above.
   • Confirm DHCP Server continues to issue addresses correctly and check basic service health.

7. What to monitor

   • Look for unusual DHCP-related network activity from devices you don’t recognize on the same local segment.
   • Monitor DHCP server logs and system/app logs for repeated error patterns around DHCP request handling (since the weakness is triggered by crafted data that causes an error path).

Severity/impact: This is an information disclosure issue (CWE-125, CWE-191) in Windows DHCP Server. The mechanism involves an integer underflow/wraparound condition in how DHCP Server processes certain values, which can lead to an error-handling path that discloses sensitive system details.

Attack vector and preconditions: Exploitation is via the adjacent network (local network proximity), and authentication is not required; no user interaction is required.

Exploitation status: There is no clear dated public claim of exploitation and no public exploit code is on record; CISA KEV does not list it. However, traffic indicates patch-related activity and new attention.

EPSS: A prediction is available (trend flat), but it is not treated as proof of exploitation.

How KEV absence affects priority: Since KEV is not listed for this CVE and incidents are not reported with clear dating, exploitation maturity is not confirmed by those sources; still, the role is a network service and the fix is available across multiple Windows branches.