CVE-2026-62823

CVE-2026-62823 is a heap-based buffer overflow (CWE-122) in the Windows DHCP Server service. Because DHCP is an unauthenticated protocol, a low-complexity attack is triggered by sending crafted DHCP traffic to the DHCP server from anywhere on an adjacent network segment (same LAN/broadcast domain) with no credentials or user interaction required. Successful exploitation yields remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8), compromising the host running the DHCP role. Organizations running the DHCP Server role on Windows Server 2012, 2016, 2019, 2022, or 2025, or the listed Windows 10 1607/1809 builds, are affected; since DHCP servers typically sit on internal networks, the primary exposure is to untrusted devices (guests, BYOD, IoT) sharing those LANs rather than the public internet. There is no known exploitation, no public proof-of-concept, and no CISA KEV listing; EPSS is 0.7% (median), and the flaw was among the 974 fixes in Microsoft's record September 2026 Patch Tuesday.

What to do: Apply Microsoft's September 2026 Patch Tuesday security updates to Windows Server 2012/2016/2019/2022/2025 and Windows 10 1607/1809, prioritizing hosts where the DHCP Server role is enabled (inventory via Get-WindowsFeature DHCP or the Microsoft-Windows-DHCP-Server feature). Until patched, restrict DHCP (UDP 67) reachability to trusted network segments and ensure guest, BYOD, and IoT networks do not share a broadcast domain with Windows DHCP servers. There is no public PoC or in-the-wild exploitation reported, but watch vendor advisories since 974 CVEs shipped in this Patch Tuesday cycle.