{"id":"CVE-2026-88216","kind":"vulnerability","aliases":["CVE-2026-88216"],"related":[],"title":"Windows DHCP Server: race condition lets an authorized attacker run code","description":"Time-of-check time-of-use (toctou) race condition in Windows DHCP Server allows an authorized attacker to execute code over a network.","summary":"A time-of-check time-of-use race condition in the Windows DHCP Server service lets an attacker who already has authorization run code over the network. The sources do not describe the exact trigger or the affected Windows versions.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcp-server","infrastructure","network-infrastructure","windows"],"not_affected_if":["no-windows-dhcp-server"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:28+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","triaged_at":"2026-11-10T19:42:59+00:00","updated_at":"2026-11-10T19:42:59+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:42:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DHCP Server: race condition lets an authorized attacker run code","impact":"high","summary":"A time-of-check time-of-use race condition in the Windows DHCP Server service lets an attacker who already has authorization run code over the network. The sources do not describe the exact trigger or the affected Windows versions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dhcp-server","network-infrastructure"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the DHCP server over the network","analyst_note":"Check the Microsoft security update guide for CVE-2026-88216 for affected Windows versions, the fixed build and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-windows-dhcp-server"],"who_is_affected":"Organizations that run the DHCP Server role on Windows machines are the exposed systems, since the flaw is in that service. The sources do not say which Windows versions or configurations are affected, so teams should check whether they run this role at all. Sites that do not run a Windows DHCP Server can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":4503,"output_tokens":468,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft security update guide for CVE-2026-88216 for affected Windows versions, the fixed build and any mitigation.","search":"'-2026':13A,16A '-88216':14A,17A 'affect':65B 'allow':83C 'alreadi':47B 'attack':9A,45B,86C 'author':8A,49B,85C 'check':30B,71C 'code':11A,51B,89C 'condit':5A,36B,78C 'cve':12A,15A 'describ':59B 'dhcp':2A,19B,40B,81C 'dhcp-server':18B 'exact':61B 'execut':88C 'infrastructur':21B,24B 'let':6A,43B 'network':23B,54B,92C 'network-infrastructur':22B 'race':4A,35B,77C 'run':10A,50B 'server':3A,20B,41B,82C 'servic':42B 'sourc':56B 'time':28B,32B,69C,73C 'time-of-check':27B,68C 'time-of-us':31B,72C 'toctou':76C 'trigger':62B 'use':34B,75C 'version':67B 'window':1A,25B,39B,66B,80C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run the DHCP Server role on Windows machines are the exposed systems, since the flaw is in that service. The sources do not say which Windows versions or configurations are affected, so teams should check whether they run this role at all. Sites that do not run a Windows DHCP Server can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dhcpserver","high","infrastructure","networkinfrastructure","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-88216':14A,17A 'attack':9A 'author':8A 'code':11A 'condit':5A 'cve':12A,15A 'dhcp':2A 'let':6A 'race':4A 'run':10A 'server':3A 'window':1A","search_b":"'affect':65B 'alreadi':47B 'attack':45B 'author':49B 'check':30B 'code':51B 'condit':36B 'describ':59B 'dhcp':19B,40B 'dhcp-server':18B 'exact':61B 'infrastructur':21B,24B 'let':43B 'network':23B,54B 'network-infrastructur':22B 'race':35B 'run':50B 'server':20B,41B 'servic':42B 'sourc':56B 'time':28B,32B 'time-of-check':27B 'time-of-us':31B 'trigger':62B 'use':34B 'version':67B 'window':25B,39B,66B","search_c":"'allow':83C 'attack':86C 'author':85C 'check':71C 'code':89C 'condit':78C 'dhcp':81C 'execut':88C 'network':92C 'race':77C 'server':82C 'time':69C,73C 'time-of-check':68C 'time-of-us':72C 'toctou':76C 'use':75C 'window':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88216","severity":null,"published_at":"2026-11-10T19:21:28+00:00","modified_at":"2026-11-10T19:21:28+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","fetched_at":"2026-11-10T19:25:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}