CVE-2026-85865: Windows DHCP Server Auth Bypass Vulnerability

CVE-2026-85865 Overview

CVE-2026-85865 is an improper authentication vulnerability in the Windows Dynamic Host Configuration Protocol (DHCP) Server. An authorized attacker with local access can bypass a security feature to compromise integrity on the affected system. The weakness is classified under [CWE-288] Authentication Bypass Using an Alternate Path or Channel.

The flaw requires low privileges, no user interaction, and local access to exploit. Successful exploitation enables an attacker to tamper with DHCP Server operations without triggering the authentication controls intended to prevent such actions. Microsoft published the advisory in the Microsoft Security Update Guide.

Critical Impact
An authorized local attacker can bypass authentication controls in Windows DHCP Server and modify server behavior, undermining the integrity of network address assignment services.

Affected Products

Windows DHCP Server role (specific Windows Server versions enumerated in the Microsoft advisory)
Refer to the Microsoft CVE-2026-85865 Update Guide for the complete list of impacted builds
Not Available in NVD CPE data at time of publication

Discovery Timeline

2026-10-13 - CVE CVE-2026-85865 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85865

Vulnerability Analysis

The vulnerability resides in the authentication logic of the Windows DHCP Server service. An authorized user on the local system can bypass a security feature intended to validate privileged DHCP operations. The attack vector is local, meaning the attacker must already have an authenticated foothold on the host running the DHCP Server role.

Exploitation does not disclose information or crash the service. Instead, the impact is confined to integrity: an attacker can perform actions that should have required stronger authentication. This category of weakness ([CWE-288]) typically arises when a secondary code path reaches privileged functionality without re-validating the caller's identity or authorization context.

The EPSS probability of exploitation sits in the lower range, consistent with vulnerabilities requiring local access and existing privileges. However, DHCP Servers often reside on domain controllers or shared infrastructure hosts, which raises the practical blast radius.

Root Cause

The root cause is improper authentication within a DHCP Server code path. According to Microsoft's advisory, a security feature can be bypassed when the server fails to enforce authentication consistently across all entry points to a protected operation. Microsoft has not published low-level technical details beyond the advisory text.

Attack Vector

The attacker must authenticate locally to the system hosting the Windows DHCP Server role with at least low privileges. From that position, the attacker invokes the vulnerable code path to bypass the security feature and modify DHCP Server state or behavior. No user interaction is required, and the scope remains unchanged. See the Microsoft Security Update Guide for exploitability guidance.

No public proof-of-concept exploit, exploit code, or in-the-wild activity has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-85865

Indicators of Compromise

No vendor-published indicators of compromise are currently available for CVE-2026-85865.
Unexpected modifications to DHCP scope, reservation, or option configurations on affected servers may indicate abuse.
Local logon activity by low-privileged accounts to DHCP Server hosts outside normal administrative windows warrants review.

Detection Strategies

Monitor Windows Event Logs for DHCP Server configuration changes, specifically events in the DhcpAdminEvents and Microsoft-Windows-Dhcp-Server/Operational channels.
Track process creation events on DHCP Server hosts for unexpected invocations of netsh dhcp or PowerShell cmdlets from the DhcpServer module by non-administrative users.
Correlate local interactive or RDP logons (Event ID 4624, logon types 2 and 10) with subsequent DHCP service interactions.

Monitoring Recommendations

Centralize DHCP Server and Windows Security event logs in a SIEM for correlation across infrastructure hosts.
Alert on any changes to DHCP server authorization status in Active Directory.
Review privileged group membership on DHCP Server hosts and enforce just-in-time elevation for administrative tasks.

How to Mitigate CVE-2026-85865

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-85865 Update Guide to all affected Windows Server hosts running the DHCP Server role.
Inventory all servers with the DHCP Server role enabled and prioritize patching based on exposure.
Audit local accounts and group memberships on DHCP Server hosts, removing unnecessary standing access.

Patch Information

Microsoft has released a security update addressing CVE-2026-85865. Consult the Microsoft Security Update Guide for the specific KB article numbers that map to each supported Windows Server version. Apply the update through Windows Update, WSUS, or your enterprise patch management tooling.

Workarounds

Microsoft has not published an official workaround. Patching is the recommended remediation path.
Restrict local and interactive logon rights on DHCP Server hosts to a minimal set of administrative accounts.
Where feasible, isolate the DHCP Server role from multi-purpose hosts to reduce the number of users who can authenticate locally.

bash

# Example: enumerate authorized DHCP servers and local administrators for review
Get-DhcpServerInDC
Get-LocalGroupMember -Group 'Administrators'
Get-LocalGroupMember -Group 'DHCP Administrators'