CVE-2026-62823

Windows DHCP Server Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 43rd percentile. A vendor fix is available.

CVSS 3.18.8High EPSS percentile43rd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-09-02Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you are running Windows DHCP Server (or any Windows device acting as a DHCP server) in the affected product list.
Identify your exact OS version (e.g., Windows Server 2019 build, Windows 10 build) and compare it to the fixed version numbers below.
Upgrade/patch immediately to one of the fixed versions:
- Windows 10: fixed in 10.0.14393.9418 or 10.0.17763.9121 (and 10.0.17763.9115 for the relevant servicing branch)
- Windows Server 2012: fixed in 6.2.9200.26280
- Windows Server 2012 R2: fixed in 6.3.9600.23338
- Windows Server 2016: fixed in 10.0.14393.9418
- Windows Server 2019: fixed in 10.0.17763.9121 (and 10.0.17763.9115 for the relevant servicing branch)
- Windows Server 2022: fixed in 10.0.20348.5499 (and 10.0.20348.5440 for the relevant servicing branch)
- Windows Server 2025: fixed in 10.0.26100.33296 (and 10.0.26100.33222 for the relevant servicing branch)
If patching must be delayed, restrict who can reach the DHCP server from other networks (network segmentation/firewall rules) until the fixed update is installed.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

In plain language

Written by AI from the record

This Windows DHCP Server flaw could let an attacker remotely take over a machine on the network—if you run DHCP on Windows Server (or Windows 10) and it’s reachable from other networks, you should patch right away.

CVE-2026-62823 is a Windows DHCP Server remote code execution vulnerability (CWE-122, heap-based buffer overflow) that can be triggered by a remote, unauthorized attacker interacting with DHCP server behavior over the network.

If you're affected

Full server takeover
Service disruption for networking
Potential theft of network credentials
Wider network compromise risk

What is it

DHCP is the service that hands out network settings (like IP addresses) to devices. This bug is in Windows’ DHCP server and could allow a remote attacker to crash it and, more seriously, run code as if they had access—like breaking into the network “traffic controller” and then issuing commands to it.

Who is affected

This matters if your organization runs Windows DHCP Server on any of these systems: Windows 10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025.

Because it’s a remote code execution issue, the risk is primarily for DHCP servers that are reachable from other networks where an attacker could send DHCP-related requests. If DHCP is not running (or is not reachable), your exposure is much lower.

How urgent is it

This is RED because it’s a remote code execution vulnerability in a core networking service (Windows DHCP Server), which can lead to full compromise of a system that many devices rely on.

There is also new press attention associated with the Lazarus group and Microsoft has published fixes, making timely patching the right move.

What to do — in detail

Confirm DHCP role/function
- On each server/PC in the affected list, verify whether it has the DHCP Server role installed and is actively serving leases.
- If DHCP is installed but not used, confirm it is not listening for DHCP requests and is not reachable.
Confirm your exact build level
- Record the OS name and build number for each candidate system.
- Compare to the fixed versions Microsoft lists for your OS/servicing branch.
Patch to the fixed versions
- Windows 10: fixed in 10.0.14393.9418 or 10.0.17763.9121 (also 10.0.17763.9115 for the relevant branch)
- Windows Server 2012: fixed in 6.2.9200.26280
- Windows Server 2012 R2: fixed in 6.3.9600.23338
- Windows Server 2016: fixed in 10.0.14393.9418
- Windows Server 2019: fixed in 10.0.17763.9121 (also 10.0.17763.9115 for the relevant branch)
- Windows Server 2022: fixed in 10.0.20348.5499 (also 10.0.20348.5440 for the relevant branch)
- Windows Server 2025: fixed in 10.0.26100.33296 (also 10.0.26100.33222 for the relevant branch)
- Use Microsoft’s update guidance page for CVE-2026-62823 to ensure you apply the correct updates for your system.
If you cannot patch immediately (temporary containment)
- Restrict network access to DHCP services: limit which subnets can reach the DHCP server.
- Add/adjust firewall rules and segmentation so untrusted networks can’t reach DHCP server traffic.
What to monitor after patching
- Confirm the DHCP service stays stable and continues issuing leases.
- Review system/network logs around DHCP activity for crashes or unusual spikes in DHCP-related errors (useful for catching scanning attempts even if no exploitation is confirmed).

CISA KEV note: This CVE is not listed in the CISA KEV feed based on the provided findings.

Technical context

CVE-2026-62823 is rated high (CVSS 8.8) and is a heap-based buffer overflow (CWE-122) in Windows DHCP Server. The practical effect described is remote code execution, meaning an attacker who can reach the DHCP service over the network may be able to run code.

From the provided findings: there is no KEV listing and no public exploit code on record. EPSS is a low predicted likelihood (trend flat), but this does not reduce the urgency because the vulnerability impacts a high-value service and Microsoft has released fixes. Press attention is new, and the findings associate actor Lazarus group with the topic; exact exploitation in the wild is not confirmed by KEV here.

Fixes are available and are OS/build-specific; apply the Microsoft-provided updates for your exact Windows version.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS43rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 43rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

13 events over 22 days, from the signal feeds we watch.

2026-09-02Patch availablerecord updated
2026-08-16Patch availablerecord updated
2026-08-14Patch availablerecord updated
2026-08-13OpenVAS check added
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 11 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector AdjacentRequires access to the local network (e.g. same Wi-Fi, Bluetooth)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable