WINDOWS SERVER 2016 · CVE-2026-88243 · Infrastructure
FIX → 10.0.14393.9688 · 10.0.17763.9487 · 10.0.20348.5870 · 10.0.26100.33822 ✓ verified
An out-of-bounds read in the Windows DHCP Server service lets an unauthenticated attacker on the network run code on the server (CVSS 9.8). Microsoft's record lists Windows Server 2016, 2019, 2022 and 2025, including Server Core, and rates exploit code maturity as unproven. Only servers with the DHCP Server role are exposed.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Windows Servers that run the DHCP Server role on Windows Server 2016, 2019, 2022 or 2025 (full and Server Core) below the fixed build. Servers without the DHCP Server role, and Windows clients, can skip it. Microsoft's record does not say which network segments can reach the flaw.
Not affected if no-dhcp-role, no-windows-dhcp-server, windows-client
Who cares dhcp, windows, windows-server
Get-WindowsFeature DHCP in PowerShell: if Installed is True, check the OS build (winver, or CurrentBuildNumber plus UBR in the registry)Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33822Upgrade to 10.0.14393.9688 · 10.0.17763.9487 · 10.0.20348.5870 · 10.0.26100.33822
10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33822