CVE-2026-62823 is a remote-code-execution vulnerability in Windows DHCP Server that Microsoft rates as more likely to be exploited. The adjacent-network vector matters because enterprise DHCP is deliberately reachable through local segments and relay agents. A service designed to hear new clients before they have an address cannot be assessed with the same exposure assumptions as an ordinary authenticated management endpoint.
Why it matters in production
The inventory should connect servers to scopes, relay addresses, failover partners, authorization in Active Directory, and the sites that depend on them. An apparently redundant pair can still share the same patch gap, upstream switch, relay configuration, or administrative failure. Teams need to know which server can continue leasing, how long partner-down transitions take, and what happens to reservations and policies during maintenance.
A controlled patch starts with replication and failover health, current configuration export, lease-database protection, and a check for stale authorized servers. Patch one partner, confirm service state, leases, options, reservations, DNS registration, and relay behavior from representative networks, then continue. A successful console login does not prove that a remote branch can obtain the correct address and reach its gateway.
The security response should also narrow exposure. Relay lists, firewall rules, management interfaces, and unused scopes deserve review while the role is visible. Old DHCP servers left authorized after migrations create both operational ambiguity and unnecessary attack surface. Removing an obsolete role can be safer than maintaining another emergency patch path indefinitely.
Practical takeaway
The practical conclusion is that DHCP patching is a network-service change, not just a Windows update. Treat failover state, relay reach, lease continuity, authorization, and post-change client tests as one runbook. DHCP is foundational infrastructure, and its resilience is proven by clients receiving the right configuration throughout the maintenance sequence.