CVE-2026-62720: Windows DHCP Server Information Disclosure Vulnerability

Microsoft’s advisory describes the bug as an integer underflow, also called wrap or wraparound, in Windows DHCP Server. The vulnerability carries a CVSS base score of 6.5 and a temporal score of 5.7. Its complete vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C.

The vector is operationally significant for DHCP administrators: the attack path is adjacent-network based, requires low attack complexity, no privileges, and no user interaction. Microsoft’s impact rating is confined to confidentiality—high confidentiality impact, with no integrity or availability impact represented in the vector—so the immediate concern is exposure of server-resident data rather than a service outage or configuration tampering.

Microsoft published the advisory on September 8, 2026. Publicly disclosed: No. Exploited: No. Microsoft’s exploitation assessment is “Exploitation Unlikely.” Customer action required: Yes.

The heap-memory disclosure described by Microsoft​

Microsoft’s official description states: “Windows DHCP Server Information Disclosure Vulnerability: Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.”

The weakness classifications are CWE-125 and CWE-191. CWE-125 covers out-of-bounds read behavior; CWE-191 covers integer underflow or wraparound. Together, those classifications fit the advisory’s information-disclosure outcome: a calculation can wrap to an unintended value, which can lead the affected process to expose memory outside its intended data boundary.

Microsoft’s accompanying advisory fact adds a concrete consequence: “FAQ-Information Disclosure-iSNS: What type of information could be disclosed by this vulnerability? An attacker who successfully exploited this vulnerability could view heap memory from a privileged process running on the server.”

The “iSNS” wording appears in the FAQ label supplied with Microsoft’s advisory material, while the vulnerability title and technical description identify Windows DHCP Server. The practical point for administrators is unchanged by that label: Microsoft describes disclosure of heap memory belonging to a privileged process on the server. Memory disclosure can expose data that should never leave the process boundary, so patching should be treated as a server-security task rather than deferred as a cosmetic DHCP update.

Fixed builds by Windows Server release​

Microsoft’s remediation is build-specific. Administrators should inventory DHCP servers by operating system version and installation type, then install the matching update and confirm that the system reaches the listed fixed build. Server Core and full installations are both covered, but they are listed separately in Microsoft’s affected-product record and should be tracked separately in change documentation.

The paired KB entries for Windows Server 2022 and Windows Server 2025 deserve attention during compliance reporting. Microsoft associates Windows Server 2022 with KB5120229 and fixed build 10.0.20348.5440, as well as KB5120242 and fixed build 10.0.20348.5499. For Windows Server 2025, the relevant pair is KB5120228 and build 10.0.26100.33222, plus KB5120233 and build 10.0.26100.33296.

What administrators should verify​

The remediation record makes the verification target unusually clear: deployment should be measured against the fixed build for the exact Windows Server product in use, rather than only against whether a patch job reports success. A DHCP host on Windows Server 2019, for example, needs KB5120238 and build 10.0.17763.9121; applying a KB intended for a different server release does not satisfy the stated remediation.

For Windows Server 2012 (Server Core installation) (x64) and Windows Server 2012 (x64), the required update is KB5120386, with fixed build 6.2.9200.26280. Windows Server 2012 R2 (Server Core installation) (x64) and Windows Server 2012 R2 (x64) require KB5120385, reaching build 6.3.9600.23338.

Windows Server 2016 (Server Core installation) (x64) and Windows Server 2016 (x64) require KB5120418 and fixed build 10.0.14393.9418. Windows Server 2019 (Server Core installation) (x64) and Windows Server 2019 (x64) require KB5120238 and fixed build 10.0.17763.9121.

For the later releases, administrators should reconcile both update/build pairs Microsoft lists. Windows Server 2022 (Server Core installation) (x64) and Windows Server 2022 (x64) are mapped to KB5120229, build 10.0.20348.5440, and KB5120242, build 10.0.20348.5499. Windows Server 2025 (Server Core installation) (x64) and Windows Server 2025 (x64) are mapped to KB5120228, build 10.0.26100.33222, and KB5120233, build 10.0.26100.33296.

CVE-2026-62720 is an information-disclosure issue rather than a denial-of-service advisory, but its adjacent-network attack vector puts attention on every affected server that provides DHCP. The immediate administrative outcome is straightforward: identify affected Windows DHCP Server deployments, apply Microsoft’s specified KB for the installed Windows Server release, and confirm the corresponding fixed build before marking the vulnerability remediated.