Microsoft’s Security Response Center describes CVE-2026-62714 as Windows DHCP Server Information Disclosure Vulnerability. The defect is an integer underflow, or wraparound, condition in Windows DHCP Server that “allows an unauthorized attacker to disclose information over an adjacent network.” The supplied Microsoft advisory record lists CWE-125 and CWE-191 for the weakness.
The exposure is limited by the attack path encoded in Microsoft’s CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C. An attacker needs adjacent-network access, but does not need prior privileges or user interaction; the potential impact is high confidentiality loss, with no integrity or availability impact in the published scoring. Microsoft’s temporal score is 5.7.
Microsoft’s assessment is Exploitation Unlikely. The advisory status fields state Publicly disclosed: No, Exploited: No, and Customer action required: Yes.
What Microsoft says could be exposed
The primary concern is disclosure of server-process memory rather than disruption of DHCP service. Microsoft’s advisory fact says: “Windows DHCP Server Information Disclosure Vulnerability: Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.”
A second official advisory fact provides the practical consequence: “FAQ-Information Disclosure-iSNS: What type of information could be disclosed by this vulnerability? An attacker who successfully exploited this vulnerability could view heap memory from a privileged process running on the server.”
That makes patch verification more important than the base score alone may suggest. Heap memory can contain data being processed by a privileged service, so an information-disclosure-only rating does not mean that exposed material is necessarily harmless. The advisory’s adjacent-network requirement does, however, focus the immediate operational priority on servers that provide DHCP to networks where untrusted or poorly segmented devices can reach the service.
The affected Windows Server releases
Microsoft’s affected-product list includes both full and Server Core installation options for every listed generation. Server Core systems must be included in normal patch compliance reporting; they use the same relevant KB and fixed build as the corresponding full installation.
For Windows Server 2012 (Server Core installation) (x64), install KB5120386 to reach fixed build 6.2.9200.26280. For Windows Server 2012 (x64), install KB5120386 to reach fixed build 6.2.9200.26280.
For Windows Server 2012 R2 (Server Core installation) (x64), install KB5120385 to reach fixed build 6.3.9600.23338. For Windows Server 2012 R2 (x64), install KB5120385 to reach fixed build 6.3.9600.23338.
For Windows Server 2016 (Server Core installation) (x64), install KB5120418 to reach fixed build 10.0.14393.9418. For Windows Server 2016 (x64), install KB5120418 to reach fixed build 10.0.14393.9418.
For Windows Server 2019 (Server Core installation) (x64), install KB5120238 to reach fixed build 10.0.17763.9121. For Windows Server 2019 (x64), install KB5120238 to reach fixed build 10.0.17763.9121.
The broader consequence for infrastructure teams is that this is not confined to the newest server release. DHCP often remains on long-lived domain and network-management servers, where Server 2012, Server 2012 R2, Server 2016, and Server 2019 installations may coexist with newer systems. Asset queries should therefore target the DHCP Server role and the installed operating-system build rather than assuming that only Windows Server 2025 needs attention.
Windows Server 2022 and 2025 have two listed update paths
Microsoft’s record contains two KB-to-build mappings for Windows Server 2022 and Windows Server 2025. The practical rule is to validate the update path deployed in the environment against the corresponding fixed build, instead of treating one KB number as universal across all servicing configurations.
For Windows Server 2022 (Server Core installation) (x64), install KB5120229 to reach fixed build 10.0.20348.5440; install KB5120242 to reach fixed build 10.0.20348.5499. For Windows Server 2022 (x64), install KB5120229 to reach fixed build 10.0.20348.5440; install KB5120242 to reach fixed build 10.0.20348.5499.
For Windows Server 2025 (Server Core installation) (x64), install KB5120228 to reach fixed build 10.0.26100.33222; install KB5120233 to reach fixed build 10.0.26100.33296. For Windows Server 2025 (x64), install KB5120228 to reach fixed build 10.0.26100.33222; install KB5120233 to reach fixed build 10.0.26100.33296.
Those paired mappings are a reason to record the post-install build in the change ticket. “Patched” is less useful operationally than proof that the DHCP host reached one of Microsoft’s listed fixed builds, especially where update management tools report only an approval state or a KB installation result.
A patching checklist for DHCP administrators
Start by identifying every server with the Windows DHCP Server role, including Server Core hosts and standby or disaster-recovery DHCP servers. Then match its exact operating system and installation type to Microsoft’s remediation entry.
- For Windows Server 2012 (Server Core installation) (x64) and Windows Server 2012 (x64), deploy KB5120386 and confirm build 6.2.9200.26280.
- For Windows Server 2012 R2 (Server Core installation) (x64) and Windows Server 2012 R2 (x64), deploy KB5120385 and confirm build 6.3.9600.23338.
- For Windows Server 2016 (Server Core installation) (x64) and Windows Server 2016 (x64), deploy KB5120418 and confirm build 10.0.14393.9418.
- For Windows Server 2019 (Server Core installation) (x64) and Windows Server 2019 (x64), deploy KB5120238 and confirm build 10.0.17763.9121.
- For Windows Server 2022 (Server Core installation) (x64) and Windows Server 2022 (x64), deploy KB5120229 for build 10.0.20348.5440 or KB5120242 for build 10.0.20348.5499.
- For Windows Server 2025 (Server Core installation) (x64) and Windows Server 2025 (x64), deploy KB5120228 for build 10.0.26100.33222 or KB5120233 for build 10.0.26100.33296.
Prioritize DHCP servers that serve shared, guest, lab, branch, or otherwise less-trusted local networks. Microsoft has not characterized CVE-2026-62714 as exploited, but its own scoring indicates an unauthenticated adjacent-network route with high confidentiality impact. The immediate administrative outcome is straightforward: patch the DHCP hosts, record the fixed build, and ensure the same review covers full and Server Core deployments.