CVE-2026-62814: Windows DHCP Server Information Disclosure Vulnerability

Overview

Severity

Medium (CVSS 6.5)

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Category

Information Disclosure

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Aug

Released

2026-08-11

Last Updated

2026-09-08

EPSS Score

0.54% (percentile: 42.8%)

Description

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

FAQ

What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability includes unauthorized access to the file system, specifically file path information.

Affected Products (12)

Windows

• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows Server 2022
• Windows Server 2022 (Server Core installation)
• Windows Server 2025 (Server Core installation)
• Windows Server 2025
• Windows Server 2016
• Windows Server 2016 (Server Core installation)

ESU

• Windows Server 2012
• Windows Server 2012 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core installation)

Security Updates (8)

• 5120238
• 5120242
• 5120229
• 5120233
• 5120228
• 5120418
• 5120386
• 5120385

Acknowledgments

Howard McGreehan with MSRC V&M, Linzishan & Anemone & Zhiniang Peng (HUST)

Revision History

• 2026-08-11: Information published.
• 2026-09-08: Updated software table to remove clients versions because this vulnerability only impacts Windows Servers. This is an informational change only.