CVE-2026-62823: Windows DHCP Server Remote Code Execution Vulnerability

CVE-2026-62823 is a remote code execution vulnerability in Windows DHCP Server, rated Critical by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it from an adjacent network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 0.53% probability of exploitation activity in the next 30 days, higher than 45% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 8 security updates (KB5120238, KB5120242, KB5120229, KB5120233 and more). It affects 12 products in 2 product families (Windows, ESU).

Key facts

CVE ID: CVE-2026-62823
Severity: High CVSS 8.8
Microsoft severity: Critical
Impact: Remote Code Execution
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: More Likely
Weakness: CWE-122
EPSS: 0.53% (percentile 45%)
CISA KEV: Not listed
Released: 11 August 2026
Last updated: 8 September 2026
Patch Tuesday: August 2026 Patch Tuesday
Product families: Windows, ESU

CVSS score and vector

Microsoft scores CVE-2026-62823 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Metric	Value
Attack vector	Adjacent network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required..

Affected products (12)

Windows

Product	Security update	Type	Fixed build	Restart
Windows Server 2019	KB5120238	Security Update	10.0.17763.9121	Yes
Windows Server 2019 (Server Core installation)	KB5120238	Security Update	10.0.17763.9121	Yes
Windows Server 2022	KB5120242 KB5120229	Security Update Security Hotpatch Update	10.0.20348.5499 10.0.20348.5440	Yes Yes
Windows Server 2022 (Server Core installation)	KB5120242 KB5120229	Security Update Security Hotpatch Update	10.0.20348.5499 10.0.20348.5440	Yes Yes
Windows Server 2025 (Server Core installation)	KB5120233 KB5120228	Security Update Security Hotpatch Update	10.0.26100.33296 10.0.26100.33222	Yes Yes
Windows Server 2025	KB5120233 KB5120228	Security Update Security Hotpatch Update	10.0.26100.33296 10.0.26100.33222	Yes Yes
Windows Server 2016	KB5120418	Security Update	10.0.14393.9418	Yes
Windows Server 2016 (Server Core installation)	KB5120418	Security Update	10.0.14393.9418	Yes

ESU

Product	Security update	Type	Fixed build	Restart
Windows Server 2012	KB5120386	Monthly Rollup	6.2.9200.26280	Yes
Windows Server 2012 (Server Core installation)	KB5120386	Monthly Rollup	6.2.9200.26280	Yes
Windows Server 2012 R2	KB5120385	Monthly Rollup	6.3.9600.23338	Yes
Windows Server 2012 R2 (Server Core installation)	KB5120385	Monthly Rollup	6.3.9600.23338	Yes

Security updates (8)

KB5120238 (Security Update)
KB5120242 (Security Update)
KB5120229 (Security Hotpatch Update)
KB5120233 (Security Update)
KB5120228 (Security Hotpatch Update)
KB5120418 (Security Update)
KB5120386 (Monthly Rollup)
KB5120385 (Monthly Rollup)

NIST NVD data

NVD status: Analyzed
NVD CVSS: 8.8 (HIGH)
NVD weakness: CWE-122
Published to NVD: 11 August 2026
NVD last modified: 14 August 2026

Affected configurations (CPE)

Product	Vulnerable versions
windows 10 1607 (x64)	before 10.0.14393.9418
windows 10 1607 (x86)	before 10.0.14393.9418
windows 10 1809 (x64)	before 10.0.17763.9115
windows 10 1809 (x86)	before 10.0.17763.9115
windows server 2012	before 6.2.9200.26280
windows server 2012 r2	all listed versions
windows server 2016	before 10.0.14393.9418
windows server 2019	before 10.0.17763.9115
windows server 2022	before 10.0.20348.5440
windows server 2025	before 10.0.26100.33222

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62823 (Vendor Advisory)

Acknowledgments

Marcos Oviedo with Deep Extract Harness
Linzishan & Anemone & Zhiniang Peng (HUST)

Revision history

Version	Date	Description
1.0	11 August 2026	Information published.
1.1	31 August 2026	Updated an acknowledgement. This is an informational change only.
1.2	8 September 2026	Updated software table to remove clients versions because this vulnerability only impacts Windows Servers. This is an informational change only.