Windows DHCP Server Elevation of Privilege Vulnerability

An attacker with local access to a server running Windows DHCP could exploit a flaw in how the DHCP service handles symbolic links to escalate their privileges to system level, potentially allowing them to take control of the entire server and any networks it manages.

Water utilities and electric utilities that run Windows Server for DHCP services should prioritize patching. This applies to any organization using Windows Server 2016, 2019, 2022, or 2025 as DHCP servers, as well as Windows 10 systems that may run DHCP relay or similar network services. The vulnerability requires local access, so it is most relevant in organizations with a distributed IT infrastructure or contract staff with server access.

An attacker with a local user account on the Windows server (such as a help desk user or contractor with logon rights) could create a symbolic link in a directory the DHCP service accesses during its normal operation. When the DHCP service processes files or paths, it follows the link without proper validation, allowing the attacker to read or write files with SYSTEM privileges. This could be leveraged to modify DHCP configurations, inject malicious code into the service, or gain system-level access.