CVE-2026-45602

A remote attacker, without authentication and without user interaction, is able to carry out a tampering attack on the Windows DHCP Server service. A network vector (AV:N) with no required attack complexity (AC:L) and no required privileges (PR:N) means that the exploit can be executed directly from the network. The detailed mechanism was not disclosed in the vendor's description.

An attacker can unauthorized modify data processed by the Windows DHCP Server service (high integrity — I:H) and gain unauthorized access to sensitive information (high confidentiality — C:H), while the availability of the service is not threatened.

Apply patches available from the vendor according to references published in the Microsoft Security Response Center (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45602)

Systems with Windows DHCP Server role enabled — versions indicated in vendor references (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45602)