Advisoriesby IbisMicrosoftCVE-2026-62803
Microsoft Windows DHCP Server: privilege escalation
Fix: upgrade to 6.2.9200.26280 or later (6 fixed versions below)
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Windows Server 2012 Product | >= 6.2.9200.0, < 6.2.9200.26280 | 6.2.9200.26280 |
| Windows Server 2012 (Server Core installation) Product | >= 6.2.9200.0, < 6.2.9200.26280 | 6.2.9200.26280 |
| Windows Server 2012 R2 Product | >= 6.3.9600.0, < 6.3.9600.23338 | 6.3.9600.23338 |
| Windows Server 2012 R2 (Server Core installation) Product | >= 6.3.9600.0, < 6.3.9600.23338 | 6.3.9600.23338 |
| Windows Server 2016 Product | >= 10.0.14393.0, < 10.0.14393.9418 | 10.0.14393.9418 |
| Windows Server 2016 (Server Core installation) Product | >= 10.0.14393.0, < 10.0.14393.9418 | 10.0.14393.9418 |
| Windows Server 2019 Product | >= 10.0.17763.0, < 10.0.17763.9121 | 10.0.17763.9121 |
| Windows Server 2019 (Server Core installation) Product | >= 10.0.17763.0, < 10.0.17763.9121 | 10.0.17763.9121 |
| Windows Server 2022 Product | >= 10.0.20348.0, < 10.0.20348.5499 | 10.0.20348.5499 |
| Windows Server 2025 Product | >= 10.0.26100.0, < 10.0.26100.33296 | 10.0.26100.33296 |
| Windows Server 2025 (Server Core installation) Product | >= 10.0.26100.0, < 10.0.26100.33296 | 10.0.26100.33296 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-59