CVE-2026-62761 Overview
CVE-2026-62761 is a link-following vulnerability [CWE-59] in the Windows Dynamic Host Configuration Protocol (DHCP) Server. An authorized local attacker can abuse improper link resolution before file access to elevate privileges on an affected host. The vulnerability requires local access and low privileges, with no user interaction needed for exploitation. Successful exploitation impacts confidentiality, integrity, and availability. Microsoft has published guidance for this issue in the Microsoft Security Response Center advisory.
Critical Impact
A local attacker with low privileges can leverage symbolic link handling in the Windows DHCP Server to gain elevated privileges, enabling further compromise of the host.
Affected Products
- Windows DHCP Server (as identified in the Microsoft advisory)
- Refer to the Microsoft advisory for the authoritative list of affected builds
- No additional Common Platform Enumeration (CPE) URIs were provided in the NVD entry at publication
Discovery Timeline
- 2026-08-11 - CVE-2026-62761 published to the National Vulnerability Database (NVD)
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-62761
Vulnerability Analysis
The vulnerability sits in how the Windows DHCP Server resolves file paths before accessing files. When the DHCP Server service opens a file, it does not adequately validate whether the target path is a symbolic link, junction, or hard link. An authorized local user can plant a link that redirects the privileged service to a file location the user does not otherwise control. The DHCP Server, running with SYSTEM-level privileges, then performs the file operation on the attacker-chosen target. The result is a local elevation of privilege from a low-privileged user context to SYSTEM.
Root Cause
The root cause is improper link resolution before file access, tracked as [CWE-59]. The DHCP Server service opens or writes to filesystem objects without enforcing checks that the final resolved path matches an expected, trusted location. Windows filesystem link primitives — NTFS junctions, symbolic links, and object manager symlinks — can redirect the privileged handle to attacker-selected targets. This is a classic filesystem redirection pattern seen in prior Windows service elevation-of-privilege issues.
Attack Vector
Exploitation requires local access and a valid low-privileged account on the target host. The attacker stages a link in a directory the DHCP Server touches, then triggers the service operation that follows the link. Because the vector is local with low privileges required and no user interaction, exploitation is feasible from any interactive or service account already present on the system. No verified public proof-of-concept exists at the time of publication, and the Exploit Prediction Scoring System (EPSS) probability is low. See the Microsoft advisory for exact affected components and update packages.
Detection Methods for CVE-2026-62761
Indicators of Compromise
- Creation of NTFS junctions, symbolic links, or hard links in directories written to by the DHCP Server service (svchost.exe hosting dhcpserver).
- File operations by the DHCP Server service targeting paths outside its expected working directories such as %SystemRoot%\System32\dhcp\.
- New or modified files in sensitive directories with a SYSTEM owner immediately after DHCP Server activity.
Detection Strategies
- Enable Windows object access auditing on DHCP Server directories and monitor Event ID 4663 for handle operations that dereference reparse points.
- Alert on CreateSymbolicLink, mklink, or FSCTL_SET_REPARSE_POINT activity from non-administrative processes.
- Correlate DHCP service restarts and configuration changes with unexpected filesystem writes to identify link-following abuse.
Monitoring Recommendations
- Collect Sysmon Event IDs 11 (file create) and 15 (file stream create) for the DHCP Server process and pipe into a central SIEM.
- Baseline normal DHCP Server file activity to surface deviations such as writes into user-writable directories.
- Track privilege changes on local accounts shortly after DHCP Server activity to catch successful elevation attempts.
How to Mitigate CVE-2026-62761
Immediate Actions Required
- Apply the security update referenced in the Microsoft advisory for CVE-2026-62761 to all Windows Server hosts running the DHCP Server role.
- Restrict interactive and remote logon rights on DHCP Server hosts to reduce the pool of accounts that can stage a local exploit.
- Audit membership of groups that can create files or links in directories used by the DHCP Server service.
Patch Information
Microsoft published patch guidance in the MSRC update guide entry for CVE-2026-62761. Administrators should identify affected Windows Server builds hosting the DHCP Server role and install the corresponding cumulative update. Verify patch installation with Get-HotFix or the Windows Update history after deployment.
Workarounds
- Limit local logon on DHCP Server hosts to administrative personnel until patches are deployed.
- Remove SeCreateSymbolicLinkPrivilege from non-administrative users via Group Policy where operationally feasible.
- Isolate the DHCP Server role on dedicated hosts to reduce the attack surface exposed to standard users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
