CVE-2026-62812 is a link-following vulnerability in Windows DHCP Server that allows an authorized local attacker to escalate to SYSTEM privileges. The CVSS 7.8 score is technically accurate but contextually misleading — the 'authorized attacker' qualifier obscures the actual threat posture. If your DHCP Server runs on domain controllers, admin workstations, or consolidated infrastructure (common deployments), the attacker who can execute code locally already occupies a position where privilege escalation collapses identity boundaries, not just local access controls.
The pattern here matters more than this single CVE. This is the fourth or fifth junction-based privilege escalation in Windows services over the past fifteen years — Print Spooler, Win32k variants, and now DHCP Server each patched individually without apparent framework-level remediation. Microsoft's secure development guidance does not appear to contain an enforceable checklist for atomic path resolution under Windows ACLs, meaning other Windows services likely harbor the same vulnerability pattern.
Treat this as a kill chain transition point, not a terminal event. The attacker who exploits this isn't just gaining a local SYSTEM shell — they're gaining a service account context that likely authenticates across multiple systems. Patch priority should be elevated accordingly, regardless of the low EPSS score, because EPSS weights remote automated exploitation that doesn't apply when local code execution is already required.
Practical steps: verify DHCP Server service account scope (where does it authenticate?), audit other Windows services on the same host for similar file resolution patterns, and treat the 'authorized local attacker' scenario as assume-compromise for infrastructure roles co-located with identity services.