Windows DHCP tampering risk shows why patch timing matters

At a glance

What this is: A Critical Windows DHCP tampering vulnerability, CVE-2026-45602, shows why exploit probability and patch timing matter before a flaw enters KEV.

Why it matters: For IAM and security teams, DHCP tampering is a reminder that network trust services underpin identity-aware access paths, so patch delay can become a control failure.

By the numbers:

• CVE-2026-45602 carries a CVSS base score of 9.1.
• FIRST.org's EPSS puts CVE-2026-45602 at 48 percent exploit probability.

Context

DHCP is the network service that assigns IP addresses, gateways, and DNS settings, so tampering with it can redirect traffic without touching the endpoint itself. That makes this vulnerability a control-plane issue, not a narrow patching problem, because the trust boundary sits between network configuration and every device that relies on it.

The identity angle is indirect but real: access governance assumes that routing, name resolution, and network reachability behave predictably. When DHCP integrity is compromised, authentication flows, service discovery, and admin access paths can all be skewed before any credential is stolen.

This pattern is typical of infrastructure vulnerabilities that look operational at first and become governance problems once exploitation risk rises.

Key questions

Q: What breaks when a Windows DHCP tampering flaw is left unpatched?

A: An attacker who can tamper with DHCP responses can influence how clients receive network configuration, which can redirect traffic, distort DNS resolution, or disrupt service reachability. The failure is at the trust boundary, not the endpoint. That is why early patching matters more than waiting for confirmation of active exploitation.

Q: Why should teams prioritise pre-KEV vulnerabilities over waiting for confirmed exploitation?

A: Pre-KEV prioritisation matters because high exploitability often appears before public confirmation of abuse. When impact is critical and exploit probability is already elevated, delaying action until KEV listing means the organisation is patching after attacker interest has already formed.

Q: How can security teams tell whether a patch programme is actually working?

A: A patch programme is working when installation success is confirmed across the full estate, exploited vulnerabilities are cleared first, and exceptions are measured rather than hidden. Strong programmes report by deployment state, not ticket completion, and they can explain which high-risk services remain exposed after each cycle.

Q: What is the difference between CVSS severity and EPSS exploit probability?

A: CVSS describes how severe the impact could be if a vulnerability is exploited, while EPSS estimates how likely exploitation is in the near term. Practitioners need both because severity alone does not tell them which flaws are most likely to be targeted first.

Technical breakdown

Why DHCP tampering changes network trust

DHCP is a control-plane service, not a content service. It tells devices where to send traffic, which DNS resolver to trust, and which gateway to use. A tampering flaw in that path can change network behaviour without modifying endpoint software or credentials. That makes the impact broader than a single server role: any host that consumes DHCP configuration can inherit the risk. In operational terms, this is a trust-integrity issue, because the control that defines network reachability becomes attacker-influenced.

Practical implication: Treat DHCP integrity as part of baseline network governance, not only as a server patching task.

Why EPSS and KEV status affect patch priority

CVSS measures severity if exploitation occurs, but it does not tell you how likely exploitation is in the near term. EPSS adds that probability layer, which is why a high EPSS score can justify urgent action before a vulnerability reaches KEV. KEV status matters because it signals confirmed abuse and usually compresses response windows. In this case, the useful decision signal is the combination: critical impact, high exploit likelihood, and no confirmed KEV listing yet.

Practical implication: Use EPSS plus KEV status to move likely-to-be-exploited flaws ahead of lower-risk patch work.

How configuration drift reopens a patched exposure

A patch cycle is not durable if the environment drifts after deployment. Servers can miss update rings, exceptions can persist, and build baselines can diverge from intended state. That is especially dangerous for long-lived Windows infrastructure because patching on paper does not guarantee consistent enforcement across all instances. The control failure is not the absence of a patch alone. It is the absence of continuous verification that the patch remains applied everywhere it matters.

Practical implication: Pair patch deployment with drift detection so the fix does not disappear between maintenance cycles.

Threat narrative

Attacker objective: The attacker aims to alter network traffic flow and weaken trust in core infrastructure services without directly compromising endpoints.

1. Entry would occur through manipulation of Windows DHCP responses in environments that expose the vulnerable component.
2. Credential access is not the primary step here, because the flaw targets network configuration integrity rather than secret theft.
3. Impact would be network redirection or service disruption, with affected endpoints consuming attacker-influenced gateway or DNS settings.

Breaches seen in the wild

• Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Patch timing has become a governance decision, not a maintenance decision. When exploit probability is already high, waiting for KEV confirmation simply hands initiative to attackers. The organisation is no longer deciding whether a vulnerability exists, but whether it will be remediated before abuse becomes visible. Practitioners should treat pre-KEV prioritisation as a core risk-management discipline.

DHCP integrity is part of identity-adjacent control, even when no credential is exposed. Routing and name-resolution trust shape how users, services, and admins reach systems, so tampering at this layer can undermine authentication journeys and administrative access paths. The practical lesson is that identity governance depends on trustworthy network primitives, not only on account policy.

Configuration drift is the named failure mode this article exposes. The vulnerable state returns when patch rings, exception handling, or server baselines diverge from intended configuration. This is not a one-time remediation story but a lifecycle control problem, and practitioners should design continuous verification around every critical Windows build.

Pre-KEV exploitation pressure is now a category-level signal for infrastructure teams. When a flaw scores high on both impact and exploit likelihood, the patch queue should be ordered by adversary interest, not by convenience. That approach aligns with modern vulnerability governance and reduces the chance that routine cycles become attacker windows.

Windows control-plane weaknesses deserve the same attention as endpoint compromise paths. A flaw that changes how devices obtain network parameters can move risk laterally across an estate without direct host compromise. Security teams should therefore map infrastructure services to business-critical trust boundaries and manage them as operational dependencies, not background plumbing.

From our research library:

• The median time to fully patch a vulnerability in CISA's Known Exploited Vulnerabilities catalog rose to 43 days, according to Verizon's 2026 Data Breach Investigations Report.

What this signals

Pre-KEV exposure is the useful signal here. Organisations that wait for KEV confirmation are already accepting a narrower response window than the attacker has. The operational shift is to rank patching by exploit likelihood plus business exposure, then verify that the fix persists across drift cycles.

Control-plane services need explicit inclusion in vulnerability governance. DHCP, DNS, and similar infrastructure components often sit outside the attention given to endpoints, yet they shape where every user and workload can go. Teams should elevate those services into the same prioritisation model they use for identity-critical systems.

For practitioners

• Prioritise pre-KEV patching for high-likelihood flaws Move CVEs with high EPSS and critical impact ahead of the regular patch queue, even before they appear in KEV, so attacker interest does not outrun remediation.
• Verify DHCP-related fixes across every Windows ring Confirm that all affected Windows Server 2019 and Windows 10 1809 systems received the cumulative update through Windows Update, WSUS, Intune, or catalog deployment.
• Add DHCP integrity checks to drift management Baseline expected network configuration and continuously compare live state against it, especially on servers that provide DHCP services or sit in path for critical routing.
• Escalate control-plane services into patch governance Include DHCP, DNS, and similar infrastructure services in the same risk-ranking process used for identity and privilege systems so network trust failures are not deprioritised.

Key takeaways

• The article shows how a network service vulnerability can become a trust problem when it affects DHCP, not just a routine patching issue.
• Its evidence is a Critical 9.1 score, a 48 percent EPSS estimate, and the fact that it is not yet in KEV.
• The practical response is to patch before exploitation pressure hardens, then keep the environment from drifting back into exposure.

Key terms

• DHCP Tampering: DHCP tampering is interference with the process that assigns network settings such as IP address, gateway, and DNS. When an attacker can alter those responses, they can change how devices reach services, making the network layer itself part of the attack surface.
• KEV-Driven Prioritisation: A remediation approach that gives known exploited vulnerabilities higher urgency because they are already in active attacker use. It is a practical way to move from severity-based backlogs to risk-based action that reflects current exploitation reality.
• Configuration Drift: Configuration drift is the gradual divergence between a system's intended secure state and the settings it actually runs with over time. In SaaS, drift often appears when admins change sharing, logging, or access controls under pressure and never return to validate the result.
• Exploit Prediction Scoring System: A daily-updated score that estimates the likelihood a vulnerability will be exploited in the near term. It does not replace severity scoring, but it adds probability context that helps teams order work before exploitation becomes widespread.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It helps security and identity practitioners connect control design to the wider governance work that keeps access trustworthy.