CVE-2026-62761 is a link-following vulnerability in the Windows DHCP Server service that enables local privilege escalation to SYSTEM. This matters because DHCP servers run at high privilege to bind ports 67/68, making them attractive targets even for attackers who already have minimal local access.
The vulnerability isn't a behavioral shift in Windows — it's legacy code carrying forward assumptions about filesystem trust that were defensible when Windows constrained symlink manipulation but are now exploitable. Developers writing DHCP server code likely assumed 'authenticated local users can't meaningfully manipulate paths this service touches.' That assumption was fragile, and the relaxation of Windows symlink constraints has collapsed it. The code compiles, the service runs, and no lint category flags 'improper link resolution' — this isn't negligence but a tooling and training gap.
The blast radius extends far beyond one machine. SYSTEM-level access to DHCP means control over what IP addresses clients receive, what next-server they contact for PXE boot, and what configuration they get on network join. Compromising a DHCP server is network-wide compromise — SYSTEM context at the bootstrap layer detonates across every client querying that server. An attacker with SYSTEM can harvest client identifiers from DHCP requests, redirect PXE boot flows, and potentially run relay chains if NTLM authentication is in play.
Key uncertainty: can DHCP protocol message processing remotely trigger the vulnerable file operations, or is exploitation strictly local requiring filesystem access? The CVSS 7.8 suggests constraints exist, likely the filesystem access prerequisite. That 'authorized local attacker' qualifier probably means anyone with login — domain-joined machines with shared accounts, development environments, or provisioning systems with filesystem write access. PXE boot environments and thin clients may fall into this category.
Audit your DHCP servers for user-writable directories in paths the service traverses. Prioritize patching — the window between CVE publication and patch deployment is exposure at the network bootstrap layer. Consider this a pattern: other Windows Server roles (DNS, Print Spooler) have shown similar link-following flaws. Until filesystem sanitization becomes a security requirement in Windows Server role development, expect more.