CVE-2026-62761 in Windows
Summary
by MITRE • 08/11/2026
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical privilege escalation flaw in the Windows Dynamic Host Configuration Protocol server implementation that operates under the Common Weakness Enumeration framework as CWE-59. The vulnerability stems from improper handling of symbolic links or hard links during file access operations within the dhcp server service, specifically when processing network configuration requests from authorized clients. An attacker with legitimate network access can exploit this weakness by manipulating file system link structures to redirect file operations to arbitrary locations, potentially gaining elevated privileges on the system.
The technical exploitation occurs when the dhcp server service processes client requests and performs file operations without properly validating or resolving symbolic links before accessing target files. This creates a window where an attacker can place malicious symbolic links in strategic locations within the file system hierarchy, causing the dhcp server to follow these links and execute code or access sensitive files with higher privileges than intended. The vulnerability specifically affects Windows dhcp server implementations and operates under the MITRE ATT&CK framework as part of privilege escalation techniques categorized under T1068.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it allows attackers to potentially compromise entire network infrastructure through lateral movement. Once elevated, an attacker can modify dhcp server configurations, redirect network traffic, or access sensitive system files that contain authentication credentials or configuration data. This weakness particularly affects enterprise environments where dhcp servers are critical infrastructure components and often run with elevated privileges to manage network configurations effectively.
Organizations should implement immediate mitigations including ensuring proper file system permissions on dhcp server directories, disabling unnecessary symbolic link creation capabilities, and applying the latest security patches from microsoft. The vulnerability demonstrates the importance of proper input validation and secure file access patterns in privileged services, aligning with security best practices outlined in the OWASP top ten and NIST cybersecurity frameworks. Regular security assessments should include testing for similar link following vulnerabilities in other system services to prevent cascading privilege escalation attacks across network infrastructure components.