---
id: "CVE-2026-88216"
page: "https://infrastack.ai/live/CVE-2026-88216"
kind: "vulnerability"
aliases: ["CVE-2026-88216"]
title: "Windows DHCP Server: race condition lets an authorized attacker run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dhcp-server", "infrastructure", "network-infrastructure", "windows", "windows-server"]
not_affected_if: ["no-windows-dhcp-server"]
published_at: "2026-11-10T19:21:28+00:00"
first_seen_at: "2026-11-10T19:25:19+00:00"
updated_at: "2026-11-10T20:47:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88216", "first_seen_at": "2026-11-10T19:25:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:47:39+00:00"}]
exploit_sources: []
---

# Windows DHCP Server: race condition lets an authorized attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-88216 (this .md is for agents)

A time-of-check time-of-use race condition in the Windows DHCP Server service lets an attacker who already has authorization run code over the network. The sources do not describe the exact trigger or the affected Windows versions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the DHCP Server role is installed on any Windows Server (PowerShell: Get-WindowsFeature DHCP; or Get-Service DHCPServer). If yes, compare the build against the MSRC Security Update Guide entry for CVE-2026-88216 (affected builds not yet read).

## Timeline

- 2026-11-10T19:25:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88216
- 2026-11-10T20:47:39+00:00 analyst — MSRC advisory page is JS-only (no text), CVRF API returned nothing; no primary text read for affected builds or KB. Nothing verified. Settle by opening the MSRC guide entry in a browser or the CVRF 2026-Nov document.

## From the sources

Time-of-check time-of-use (toctou) race condition in Windows DHCP Server allows an authorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_