CVE-2026-88119

8.1High

Published 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-416

Impact

Unauthenticated attackers can execute arbitrary code over the network on machines running Windows DHCP Server. They need network access to send crafted DHCP packets to the service.

Root cause

A use-after-free memory flaw occurs when processing network traffic in the Windows DHCP Server service.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Apply the official security update from Microsoft for your Windows Server release. If patching immediately is not possible, stop and disable the DHCP Server service or restrict network access to UDP ports 67 and 68.

shell

$ Stop-Service -Name DHCPServer -Force; Set-Service -Name DHCPServer -StartupType Disabled

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88119

Source: nvd.nist.gov/vuln/detail/CVE-2026-88119