CVE-2026-62814

DHCP Server is the “automatic address assignment” service that helps devices on your network get the right network settings (like IP address details). This vulnerability lets someone on the same local network trick the DHCP server into revealing private information about the computer that runs it. It doesn’t require a login, so the main protection is keeping the DHCP server fully patched and limiting who can reach it over the local network.

This matters if you run Windows DHCP Server on one of these systems: windows 10, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2025, or windows server 2012 r2. The attacker does not need an account; the risk exists from an adjacent network position on the same local network segment.

Reachability gate: it’s a risk when an attacker can reach the DHCP server from the local network they share (adjacent network access).

Treat this as urgent because the issue is a patch-relevant information disclosure in a network service and does not require authentication. Even though there are no clear, dated public incidents reported for this specific CVE, the update is the correct mitigation and the affected role is commonly reachable from the internal network.

Given the RED verdict, prioritize patching on DHCP servers as part of your next scheduled maintenance window (or sooner if you have a DHCP server exposed to many internal segments).