Microsoft Windows DHCP Server contains an insufficient verification of authenticity for data, permitting an authorized user with local access to bypass a defined security feature. This flaw represents a CWE‑288 authentication bypass weakness and can let the attacker alter or evade controls that protect DHCP operations, potentially undermining the confidentiality and integrity of DHCP configuration data.

The affected versions cover Microsoft Windows 10 (1607 and 1809) and a range of Windows Server editions, from 2012 through 2025, including both full and Server Core installations. All listed builds are susceptible to this bypass when the DHCP server service is present.

The assessment assigns a CVSS score of 5.5, indicating medium severity; the EPSS score is 0.00288, indicating a very low exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. Because the flaw requires local authorized privileges, it is unlikely to be exploited remotely, and no public exploits have been identified. Nonetheless, local administrators with discretionary access could take advantage of the bypass to modify DHCP settings without authorization.