The vulnerability is a missing authentication check in a critical function of the Windows DHCP Server, allowing an attacker who can reach the server over a network to elevate privileges. Because the server accepts privileged requests without validating credentials, the attacker can gain higher permissions and potentially take full control of the system. This flaw is classified as CWE‑306.

Affected systems include Microsoft Windows 10 release 1607 and 1809, and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and Server Core installations). No specific patch levels are listed, but all versions listed are susceptible until the Microsoft update is applied.

The CVSS score of 6.8 indicates a moderate risk, and although EPSS data is missing, the absence from the KEV catalog suggests no widespread public exploits yet. The flaw remains exploitable in environments where attackers can reach the DHCP service, such as internal networks or DMZs, and requires the attacker to have basic network connectivity to the server. Once the vulnerable function is invoked without authentication, the attacker can elevate privileges and potentially compromise the entire host.