CVE-2026-62807: Windows DHCP Server Privilege Escalation

CVE-2026-62807 Overview

CVE-2026-62807 is a link-following vulnerability [CWE-59] in Windows DHCP Server. An authorized local attacker can abuse improper link resolution before file access to elevate privileges on an affected host. Microsoft published the advisory on August 11, 2026.

The flaw carries a CVSS 3.1 base score of 7.8. Successful exploitation grants high impact to confidentiality, integrity, and availability. The attacker needs local access and low privileges, but no user interaction. EPSS currently rates exploitation probability at 0.38% (30.95 percentile).

Critical Impact
A local, authenticated attacker can leverage symbolic or hard link manipulation against the Windows DHCP Server to gain SYSTEM-level privileges on the host.

Affected Products

Windows DHCP Server (Microsoft)
Refer to the Microsoft Security Update Guide for the authoritative list of impacted Windows Server builds

Discovery Timeline

2026-08-11 - CVE-2026-62807 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62807

Vulnerability Analysis

The issue resides in the Windows DHCP Server service, which performs file operations without adequately validating that referenced paths do not traverse symbolic links, junctions, or hard links. Because the DHCP Server service runs with elevated privileges, an attacker who can plant or influence a link before the service accesses a target file can redirect that access to a location the attacker would not normally control.

This pattern, tracked as [CWE-59] Improper Link Resolution Before File Access, enables privilege escalation from a standard authenticated user to SYSTEM. The attacker typically races the service to create a link at a predictable path used during DHCP operations such as log rotation, backup, or configuration read/write.

Root Cause

The root cause is missing or incomplete reparse-point validation in file-handling routines invoked by the DHCP Server service. The service opens files by path rather than by verified handle, and does not enforce flags such as FILE_FLAG_OPEN_REPARSE_POINT or check for symlink/junction ownership before writing.

Attack Vector

Exploitation requires local access with a low-privileged account on a host running the Windows DHCP Server role. The attacker creates an NTFS junction, symbolic link, or hard link that points from a location the DHCP service writes to toward a sensitive system file. When the service performs the file operation, it follows the link and reads, writes, or overwrites the target with SYSTEM privileges. No user interaction is required.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported for CVE-2026-62807 at the time of publication. See the Microsoft advisory for vendor-supplied technical detail.

Detection Methods for CVE-2026-62807

Indicators of Compromise

Unexpected NTFS junctions, symbolic links, or hard links created in directories accessed by the DHCP Server service, such as %SystemRoot%\System32\dhcp\
File writes performed by svchost.exe hosting the DHCP service targeting paths outside the DHCP working directory
New or modified files under protected system paths with timestamps aligned to DHCP service activity

Detection Strategies

Monitor Sysmon Event ID 11 (FileCreate) and Event ID 15 for reparse-point creation by non-administrative users in DHCP-related directories
Alert on process activity where the DHCP Server service writes to paths outside its expected working set
Correlate local logons or interactive sessions with subsequent link creation and DHCP service file operations

Monitoring Recommendations

Enable object-access auditing on %SystemRoot%\System32\dhcp\ and other DHCP data directories
Ingest Windows Security, Sysmon, and DHCP service logs into a central SIEM for behavioral correlation
Baseline normal DHCP Server file activity so link-following anomalies stand out during triage

How to Mitigate CVE-2026-62807

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62807 to all Windows Server hosts running the DHCP Server role
Inventory servers with the DHCP Server role enabled and prioritize patching for domain-joined and internet-adjacent systems
Restrict interactive and remote local logon rights on DHCP servers to reduce the pool of accounts able to stage an exploit

Patch Information

Microsoft has released a security update addressing CVE-2026-62807. Administrators should consult the Microsoft Security Update Guide for the specific KB article and build numbers applicable to each Windows Server version, then deploy through Windows Update, WSUS, or their standard patch management workflow.

Workarounds

No official workaround replaces the security update; patching is the recommended remediation
Limit local logon on DHCP servers to administrative personnel until the update is deployed
Tighten NTFS permissions on DHCP working directories so non-privileged users cannot create reparse points

bash

# Example: identify Windows Servers with the DHCP role for patch prioritization
Get-WindowsFeature -Name DHCP | Where-Object { $_.Installed -eq $true }

# Example: audit reparse points under the DHCP data directory
Get-ChildItem -Path "$env:SystemRoot\System32\dhcp" -Recurse -Force |
  Where-Object { $_.Attributes -match 'ReparsePoint' }