CVE-2026-62812: Windows DHCP Server Privilege Escalation

CVE-2026-62812 Overview

CVE-2026-62812 is a local privilege escalation vulnerability in the Windows Dynamic Host Configuration Protocol (DHCP) Server component. The flaw stems from improper link resolution before file access, classified under [CWE-59]. An authorized attacker with local access can abuse symbolic or hard link handling to redirect privileged file operations to targets they should not control. Successful exploitation grants the attacker elevated privileges on the affected host. Microsoft published the advisory on 2026-08-11 and last updated the entry on 2026-08-12.

Critical Impact
An authorized local attacker can elevate privileges to SYSTEM by manipulating file links processed by the Windows DHCP Server service, leading to full confidentiality, integrity, and availability compromise of the host.

Affected Products

Windows DHCP Server (Windows Server role component)
Windows Server versions listed in the Microsoft Security Update Guide advisory
Systems where the DHCP Server role is installed and enabled

Discovery Timeline

2026-08-11 - CVE-2026-62812 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62812

Vulnerability Analysis

The vulnerability resides in how the Windows DHCP Server service resolves file paths that contain filesystem links. When the service accesses a file, it fails to validate whether the path traverses a symbolic link, hard link, or mount point before performing privileged operations. An attacker who can create links in a location the DHCP Server writes to or reads from can redirect those operations to arbitrary targets.

Because the DHCP Server service runs with elevated privileges, redirected writes can overwrite protected files or alter configuration under the security context of the service. This yields high impact to confidentiality, integrity, and availability of the affected system.

The issue requires local access and low-privileged authenticated permission, but no user interaction. Attack complexity is low, meaning a reliable exploitation primitive can be built once a suitable link target is identified.

Root Cause

The root cause is a missing or incomplete check for link resolution ([CWE-59]) in the DHCP Server file-access code path. The service opens or writes files without using flags such as FILE_FLAG_OPEN_REPARSE_POINT semantics or equivalent verification. This allows filesystem redirection primitives to be planted before the privileged operation runs.

Attack Vector

Exploitation requires the attacker to hold a local, authenticated account on a Windows host running the DHCP Server role. The attacker plants a link, such as an NTFS junction combined with an object-manager symlink, that points a file the DHCP Server touches to a target the attacker cannot normally write. When the service performs its file operation, it follows the link and writes with SYSTEM-level privileges. No user interaction is required, and the attack is limited to the local machine scope.

No public proof-of-concept exploit is currently listed for CVE-2026-62812, and it is not present on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.298%. Refer to the Microsoft Security Update Guide advisory for authoritative technical detail.

Detection Methods for CVE-2026-62812

Indicators of Compromise

Creation of NTFS junctions, mount points, or reparse points inside directories written to by the DHCP Server service (for example, paths under %SystemRoot%\System32\dhcp\).
Unexpected file modifications in protected system directories with a timestamp correlating to DHCP Server service activity or restart.
New or modified privileged accounts, services, or scheduled tasks created shortly after DHCP Server file operations.

Detection Strategies

Monitor process activity for svchost.exe hosting the DHCP Server service performing file writes outside of its expected working directories.
Alert on creation of reparse points by non-administrative users, particularly in paths accessed by system services.
Correlate Windows Security event ID 4663 (object access) against DHCP Server service paths to detect anomalous file handle activity.

Monitoring Recommendations

Enable object-access auditing on the DHCP Server data directory and review write operations that originate from unexpected callers.
Ingest Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateTime) into the SIEM to surface link-planting behavior.
Track service restarts of DHCPServer outside change windows, as attackers may trigger service restarts to force the vulnerable file operation.

How to Mitigate CVE-2026-62812

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62812 to all Windows Servers running the DHCP Server role.
Inventory hosts with the DHCP Server role enabled and prioritize patching for domain controllers and other high-value systems that also host DHCP.
Restrict interactive and remote logon rights on DHCP Servers to reduce the population of accounts able to stage a local exploit.

Patch Information

Microsoft has issued a security update through the Microsoft Security Update Guide. Administrators should deploy the update via Windows Update, Windows Server Update Services (WSUS), or an equivalent patch-management pipeline. Consult the Microsoft Security Update Guide advisory for the specific KB article, affected build ranges, and superseded updates.

Workarounds

Remove the DHCP Server role from hosts that no longer require it, reducing the attack surface until the patch is applied.
Limit local logon rights on DHCP Servers through Group Policy so only administrators can obtain the local, authenticated foothold required for exploitation.
Audit and remove unnecessary write permissions on directories accessed by the DHCP Server service to make link-planting harder for low-privileged users.

bash

# Query DHCP Server role status and installed updates on a Windows Server
Get-WindowsFeature -Name DHCP
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20