CVE-2026-62803: Windows DHCP Server Privilege Escalation

CVE-2026-62803 Overview

CVE-2026-62803 is a local privilege escalation vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. The flaw results from improper link resolution before file access, commonly known as link following [CWE-59]. An authorized attacker with low privileges can abuse symbolic or hard link handling to access or modify files outside their intended scope. Successful exploitation grants elevated privileges on the affected host.

Critical Impact
An authorized local attacker can escalate to higher privileges by manipulating file system links processed by the Windows DHCP Server service, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

Windows DHCP Server (Windows Server platforms with the DHCP Server role installed)

Discovery Timeline

2026-08-11 - CVE-2026-62803 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62803

Vulnerability Analysis

The Windows DHCP Server service resolves file paths without adequately validating whether path components are symbolic links, junctions, or hard links. An attacker who already holds local, low-privileged access on the host can plant a crafted link that redirects a privileged file operation to a target the attacker does not otherwise control. Because the DHCP Server service runs with elevated privileges, the redirected write or open executes in that higher security context.

The issue is categorized under [CWE-59]: Improper Link Resolution Before File Access. This class of flaw is a common source of local elevation-of-privilege bugs on Windows, where reparse points and NTFS junctions can be created by unprivileged users.

Exploitation requires no user interaction and no network access. The attack surface is limited to hosts running the Windows DHCP Server role, which restricts wide-scale exploitation but exposes domain infrastructure servers that typically host the role.

Root Cause

The DHCP Server service performs file operations against paths that a low-privileged local user can influence through NTFS reparse points. The service does not verify the final target of the path before opening, writing, or replacing files, allowing a link-following redirection attack.

Attack Vector

An authenticated local attacker creates a reparse point or hard link within a directory used by the DHCP Server service. When the service performs a privileged file operation, it follows the attacker-planted link and acts on an arbitrary target file. The attacker leverages this arbitrary file write or overwrite primitive to execute code as SYSTEM or replace a security-relevant configuration file. The vulnerability is described in the Microsoft Security Update Guidance.

Detection Methods for CVE-2026-62803

Indicators of Compromise

Creation of reparse points, NTFS junctions, or hard links inside directories accessed by the DHCP Server service (%SystemRoot%\System32\dhcp\ and related paths).
Unexpected modifications to system files or DHCP configuration files performed under the DHCP Server service context.
New service installations, scheduled tasks, or SYSTEM-level processes spawned shortly after DHCP Server file activity by non-administrative users.

Detection Strategies

Monitor Windows Security event IDs 4663 and 4656 for file access by the DHCP Server service to paths outside its expected working directories.
Alert on CreateSymbolicLink, mklink /J, or reparse point creation by non-administrative users in directories touched by privileged services.
Correlate DHCP Server service file writes with subsequent process launches running as NT AUTHORITY\SYSTEM originating from user-writable locations.

Monitoring Recommendations

Enable file system auditing on DHCP Server working directories and any locations where the service writes lease databases or logs.
Baseline normal DHCP Server file activity and alert on deviations, particularly writes traversing reparse points.
Aggregate endpoint telemetry into a central SIEM to correlate privilege escalation indicators across DHCP-enabled servers.

How to Mitigate CVE-2026-62803

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guidance to all Windows Servers running the DHCP Server role.
Inventory all systems with the DHCP Server role installed and prioritize patching for domain-joined and Active Directory-adjacent hosts.
Restrict interactive and remote logon rights on DHCP servers to reduce the pool of authorized users who could stage the attack.

Patch Information

Microsoft has released fixes through its monthly security update channel. Refer to the Microsoft Security Update Guidance for the specific KB articles and cumulative updates applicable to each supported Windows Server version. Apply the updates through Windows Update, WSUS, or your enterprise patch management platform, then reboot to complete installation.

Workarounds

Limit local logon and Remote Desktop access on DHCP servers to trusted administrative accounts only.
Enforce least privilege on directories used by the DHCP Server service and remove non-administrative write access from parent paths.
Enable Windows Defender Attack Surface Reduction rules and file system auditing to detect link-planting behavior until patches are deployed.

bash

# Verify the DHCP Server role and check installed updates on a Windows Server
Get-WindowsFeature -Name DHCP
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20