Windows DHCP Server Security Feature Bypass Vulnerability (CVE-2026-83787)

Microsoft has identified a flaw in the Windows DHCP Server that allows an authenticated local user to bypass a built‑in security feature. The vulnerability stems from inadequate verification of data authenticity, enabling the attacker to manipulate DHCP operations without detection.

What Happened

The flaw, cataloged as CVE-2026-83787, permits a local attacker with sufficient privileges to override DHCP security controls. By crafting specific DHCP packets, the attacker can gain unauthorized access to configuration settings.

Impact

• All Windows Server editions that run the DHCP Server role are affected.
• Potential for unauthorized lease assignments, spoofing, or denial of service.
• Could serve as a foothold for further lateral movement within the network.

What to Do

• Apply the latest Microsoft security update for Windows DHCP Server (KBxxxxxx).
• Restrict local administrator rights on servers that host DHCP services.
• Disable the DHCP Server role on machines that do not require it.
• Enable auditing for DHCP configuration changes and monitor for anomalous packets.

Monitoring & Detection

Look for unexpected DHCP lease requests or configuration changes that originate from non‑trusted sources. Correlate with Windows Event ID 4720/4722 for account creation/modification and 4688 for process creation.