{"id":"CVE-2026-105588","kind":"vulnerability","aliases":["CVE-2026-105588"],"related":[],"title":"Windows DHCP Server: missing authentication lets a local user gain higher privileges","description":"Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges locally.","summary":"Windows DHCP Server has a missing authentication check on a critical function. An attacker who already has an account on the machine can use it to elevate their privileges.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcp","infrastructure","windows","windows-server"],"not_affected_if":["no-dhcp-server-role"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:01+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","triaged_at":"2026-11-10T19:58:22+00:00","updated_at":"2026-11-10T19:58:22+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:58:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows DHCP Server: missing authentication lets a local user gain higher privileges","impact":"high","summary":"Windows DHCP Server has a missing authentication check on a critical function. An attacker who already has an account on the machine can use it to elevate their privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server","dhcp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher privileges on the DHCP server","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-105588 for affected Windows versions and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-dhcp-server-role"],"who_is_affected":"Only servers running the Windows DHCP Server role are relevant, and the attacker must already have an authorized local account on the machine. The sources do not say which Windows versions are affected or which configurations are required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":4489,"output_tokens":411,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105588':15A,18A '-2026':14A,17A 'account':43B 'allow':63C 'alreadi':40B 'attack':38B,66C 'authent':5A,31B,55C 'author':65C 'check':32B 'critic':35B,57C 'cve':13A,16A 'dhcp':2A,19B,26B,61C 'elev':51B,68C 'function':36B,58C 'gain':10A 'higher':11A 'infrastructur':20B 'let':6A 'local':8A,70C 'machin':46B 'miss':4A,30B,54C 'privileg':12A,53B,69C 'server':3A,24B,27B,62C 'use':48B 'user':9A 'window':1A,21B,23B,25B,60C 'windows-serv':22B","nicknames":[],"mitigations":[],"who_affected":"Only servers running the Windows DHCP Server role are relevant, and the attacker must already have an authorized local account on the machine. The sources do not say which Windows versions are affected or which configurations are required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dhcp","infrastructure","medium","windows","windowsserver"],"campaign_type":null,"search_a":"'-105588':15A,18A '-2026':14A,17A 'authent':5A 'cve':13A,16A 'dhcp':2A 'gain':10A 'higher':11A 'let':6A 'local':8A 'miss':4A 'privileg':12A 'server':3A 'user':9A 'window':1A","search_b":"'account':43B 'alreadi':40B 'attack':38B 'authent':31B 'check':32B 'critic':35B 'dhcp':19B,26B 'elev':51B 'function':36B 'infrastructur':20B 'machin':46B 'miss':30B 'privileg':53B 'server':24B,27B 'use':48B 'window':21B,23B,25B 'windows-serv':22B","search_c":"'allow':63C 'attack':66C 'authent':55C 'author':65C 'critic':57C 'dhcp':61C 'elev':68C 'function':58C 'local':70C 'miss':54C 'privileg':69C 'server':62C 'window':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105588","severity":null,"published_at":"2026-11-10T19:18:01+00:00","modified_at":"2026-11-10T19:18:02+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","fetched_at":"2026-11-10T19:24:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}