CVE-2026-88117 – Windows DHCP Server Remote Code Execution Vulnerability

Microsoft has addressed a critical Remote Code Execution (RCE) vulnerability in Windows DHCP Server that could allow an unauthenticated attacker to execute malicious code remotely. The vulnerability, identified as CVE-2026-88117, results from a Use-After-Free (UAF) memory management flaw. An attacker could exploit this weakness by sending a specially crafted network packet to an affected DHCP service. Although exploitation requires a complex race condition, the vulnerability is particularly concerning because it requires neither authentication nor user interaction. Successful exploitation could compromise the confidentiality, integrity, and availability of affected systems.

CVSS SCORE: 8.1

SEVERITY: Critical

Threat

This vulnerability presents a significant security risk to organizations operating affected Windows DHCP Server environments.

An attacker with network access to a vulnerable DHCP service could potentially execute malicious code without needing valid credentials or assistance from a user.

The vulnerability is particularly dangerous because DHCP servers provide essential network services, making them important components of enterprise infrastructure.

Successful exploitation could lead to:

• Unauthorized execution of malicious code on affected servers.
• Exposure or theft of sensitive business information.
• Modification or destruction of critical system data.
• Disruption of DHCP services and network connectivity.
• Loss of system availability and interruption of business operations.

The attack complexity is rated High because successful exploitation requires winning a race condition.

Despite this complexity, the combination of remote exploitation, no authentication requirements, and potentially severe consequences makes this a critical security concern.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

The reported exploitation status is:

• Publicly Disclosed: No
• Exploited: No
• Exploit Code Maturity: Unproven
• Zero-Day Exploitation: No exploitation reported.
• Proof-of-Concept (PoC): No publicly available PoC is confirmed.

There is currently no reported evidence of active exploitation.

However, the vulnerability could potentially be exploited remotely without authentication.

Although exploitation is technically challenging, attackers who successfully manipulate the required race condition could execute malicious code on affected systems.

Technical Summary

CVE-2026-88117 is a critical Use-After-Free (CWE-416) vulnerability affecting Windows DHCP Server.

A Use-After-Free vulnerability occurs when an application attempts to access memory after that memory has already been released.

This can result in unexpected application behavior, memory corruption, or potentially remote code execution.

In this case, the vulnerability exists within Windows DHCP Server and can be triggered through specially crafted network packets.

An unauthenticated attacker could send a malicious packet to the affected DHCP service and attempt to manipulate the server’s memory handling.

Successful exploitation requires the attacker to win a race condition, meaning specific operations must occur in a particular sequence or timing.

This requirement increases exploitation difficulty and contributes to the High Attack Complexity rating.

However, if the attack succeeds, the attacker could execute arbitrary code on the targeted system.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability could allow an attacker to compromise the affected system’s security and potentially disrupt critical network infrastructure.

Exploitability

The vulnerability affects the following Microsoft operating systems:

• Windows Server 2012 and 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025
• Windows Server Core installations of the affected server versions
• Windows 10 Version 1607 (x64)
• Windows 10 Version 1809 (32-bit and x64)

An attacker could exploit the vulnerability by sending a specially crafted network packet to an affected DHCP service.

No authentication or user interaction is required.

However, exploitation is considered less likely because the attacker must successfully trigger a race condition.

Business Impact

Windows DHCP Server plays an important role in enterprise networks by supporting automatic IP address allocation and network connectivity.

Compromising a DHCP server could have serious consequences for organizations that depend on these services.

1. Critical Infrastructure Compromise

Successful exploitation could allow attackers to execute malicious code on an affected server.

This could compromise an important component of the organization’s network infrastructure.

2. Business Operations Disruption

An attack affecting the availability of DHCP services could interrupt network connectivity for systems that depend on those services.

Such disruptions could affect employee productivity, business applications, and essential IT operations.

3. Sensitive Data Exposure

Because the vulnerability carries a High Confidentiality Impact rating, successful exploitation could expose sensitive information stored or processed on compromised systems.

4. System Integrity Risks

Attackers could potentially modify or destroy important system information, affecting the reliability and security of compromised servers.

5. Financial and Operational Consequences

Organizations could face operational downtime, incident response expenses, system recovery costs, and potential financial losses following successful exploitation.

“When a critical network service is compromised, the damage may extend beyond one server and affect the entire business operation.”

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

If immediate patching is not possible, organizations should consider temporary risk-reduction measures:

• Restrict network access to DHCP services to trusted networks and systems wherever operationally feasible.
• Use network segmentation to limit unnecessary exposure of affected servers.
• Monitor DHCP servers for suspicious network traffic and unusual activity.
• Prioritize security monitoring of affected systems until patches can be deployed.

These measures may reduce exposure but do not eliminate the underlying vulnerability.

Applying the official Microsoft security updates remains the recommended remediation.

Urgency

Critical Severity – Prioritize Patch Deployment

CVE-2026-88117 should receive high patching priority because it affects Windows DHCP Server and could allow unauthenticated remote code execution.

Although Microsoft considers exploitation less likely and no active exploitation has been reported, the potential consequences remain significant.

The vulnerability is particularly concerning for organizations operating DHCP services that are accessible from untrusted network segments.

A successful attack could compromise critical servers, expose sensitive information, and interrupt essential network services.

Microsoft has released official security fixes for affected operating systems.

Relevant security updates include:

• KB5126835: Windows Server 2012
• KB5126836: Windows Server 2012 R2
• KB5126868: Windows Server 2016 and Windows 10 Version 1607
• KB5126651: Windows Server 2019 and Windows 10 Version 1809
• KB5126655: Windows Server 2022
• KB5126646: Windows Server 2025

A system restart is required after installing the applicable security update.

Organizations should prioritize affected DHCP servers, schedule patch deployment during appropriate maintenance windows, and verify successful installation.

The absence of known exploitation reduces the immediate threat, but it does not remove the risk of a critical remote code execution vulnerability.