CVE-2026-85865 in Windows
Summary
by MITRE • 10/14/2026
Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified within the Microsoft Dynamic Host Configuration Protocol (DHCP) server service represents a critical failure in access control mechanisms, specifically categorized under CWE-287 as Improper Authentication. This flaw resides in how the DHCP Server component validates credentials and session states when processing administrative requests or configuration changes initiated by users who are already authenticated to the operating system. While the attacker is required to possess valid local user credentials, which classifies this primarily as a Local Privilege Escalation scenario rather than an unauthenticated remote exploit, the severity lies in the ability of such an authorized actor to bypass specific security features that are designed to restrict administrative actions or isolate sensitive configuration parameters. The core technical flaw involves a logic error where the DHCP service fails to enforce mandatory access controls properly during certain internal API calls or registry interactions, allowing a user with standard privileges to manipulate server settings that should be restricted to higher-privileged accounts such as Administrators or Domain Admins.
From an operational perspective, this vulnerability allows an attacker who has gained initial foothold on the network through phishing, malware infection, or other means of local code execution to escalate their privileges without needing additional exploits or password cracking efforts. By leveraging improper authentication checks within the DHCP service, the attacker can modify critical server configurations, such as lease durations, scope options, or relay agent settings. This capability significantly expands the attack surface by enabling the manipulation of network traffic routing and IP address allocation. An adversary could potentially redirect client requests to malicious servers, disrupt network connectivity for specific segments of the infrastructure, or exfiltrate sensitive information regarding internal network topology through DHCP option fields. The impact is particularly severe in environments where the DHCP server hosts critical DNS integration settings or integrates with Active Directory for dynamic updates, as compromising these functions can lead to broader lateral movement and persistence within the domain.
The exploitation technique aligns closely with MITRE ATT&CK techniques related to privilege escalation and defense evasion, specifically T1068 Exploitation for Privilege Escalation and potentially T1542 System Service Discovery if used in conjunction with other tools to map out network dependencies. The vulnerability highlights the risk associated with services that run under high-privilege contexts but expose interfaces that do not strictly enforce role-based access control boundaries during every internal operation. Security analysts note that such flaws often stem from legacy code paths or overly permissive default configurations where the principle of least privilege is not rigorously applied to all administrative functions within a single service binary.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is the timely application of Microsoft security updates that patch this specific authentication bypass logic in the DHCP Server component. Organizations should ensure their Windows server infrastructure is fully patched against known CVEs affecting network services. In addition to patching, implementing strict least-privilege principles for all service accounts and administrative users is essential; no user requiring only standard workstation access should have local administrator rights on critical infrastructure servers like DHCP or DNS hosts. Network segmentation further reduces risk by isolating the DHCP server from general user workstations where possible, ensuring that even if an attacker compromises a client machine, they cannot directly interact with the DHCP service API without passing through additional network security controls such as firewalls or intrusion detection systems. Regular auditing of administrative actions and monitoring for anomalous configuration changes within the DHCP logs can also aid in early detection of exploitation attempts before significant damage occurs.