CVE-2026-62803

CVE-2026-62803 is a symlink-following vulnerability in Windows DHCP Server that allows an attacker with local file-system write access to manipulate path resolution and escalate to SYSTEM privileges. The vulnerability is not an isolated flaw—it is the latest manifestation of a recurring pattern across Microsoft's privileged Windows services, appearing previously in DNS Server and Active Directory Certificate Services with the same structural fingerprint: path strings passed to CreateFile in privileged contexts where symlink manipulation is available to low-privilege principals. The severity extends well beyond local privilege escalation. Compromising the DHCP service grants control over IP assignment, DNS resolution, and gateway routing for every client on the affected network segment. This is a man-in-the-middle pivot, not merely a local-root vulnerability—an attacker controlling DHCP can establish persistent network-level presence that survives credential rotation and host-based firewalls. The "authorized attacker" constraint in the CVE description describes the entry point, not the blast radius. Windows file APIs make link-following the default behavior with no compiler warnings, runtime friction, or framework defaults that push developers toward safer patterns. The API design makes unsafe patterns feel safe: developers write path checks that operate on the pre-resolution path while actual file access operates on the resolved path—a classic TOCTOU gap where the 'time' dimension is architectural rather than temporal. Notably, Windows still lacks an equivalent to Unix's O_NOFOLLOW flag that would allow developers to explicitly opt out of link resolution. Prioritize patching this CVE despite the EPSS score of 0.0038. That score reflects current exploit availability, not exploitability after public PoC code emerges—which has historically occurred rapidly for this vulnerability class. The window between disclosure and reliable exploitation is where defensive response matters most. Additionally, audit your environment for other Windows services using similar file-access patterns: the recurrence of this genetic sequence across multiple Microsoft services suggests the architectural vulnerability is systemic rather than isolated. If you maintain Windows Server DHCP infrastructure, verify the patch status immediately. For long-term defense, examine whether your privileged services perform explicit path canonicalization before file access—or whether they depend on the implicit (and unsafe) link-following behavior of CreateFile.

Reviewed through automated stages and approved by a human before publication.