CVE-2026-88119 – Windows DHCP Server Remote Code Execution Vulnerability

CVE-2026-88119 is a Critical Remote Code Execution (RCE) vulnerability affecting the Windows DHCP Server service across multiple versions of Microsoft Windows Server and Windows 10. The vulnerability exists because of a Use-After-Free (CWE-416) memory management flaw that could allow an unauthenticated remote attacker to execute malicious code by sending specially crafted network packets to an affected system. Successful exploitation could compromise system confidentiality, integrity, and availability. Although exploitation requires winning a race condition, making attacks more difficult, the vulnerability remains dangerous because no authentication or user interaction is required. Microsoft has released security updates to address this issue.

CVSS SCORE: 8.1 (High).

SEVERITY: Critical.

Threat

This vulnerability presents a serious security threat to organizations operating affected Windows DHCP Server environments.

An attacker with network access to a vulnerable DHCP service could potentially execute arbitrary code without needing valid credentials or assistance from a user.

Because DHCP servers support essential network operations, successfully compromising one could have significant consequences for an organization’s IT infrastructure.

Potential threats include:

• Remote System Compromise: Attackers could execute malicious code on vulnerable systems.
• Unauthorized Access: Successful exploitation could provide attackers with an opportunity to compromise sensitive information.
• Service Disruption: Attackers could potentially interfere with DHCP services, affecting network connectivity and business operations.
• Infrastructure Exposure: Compromised DHCP servers could become an entry point for further attacks against organizational infrastructure.

The vulnerability carries a High impact rating for confidentiality, integrity, and availability, highlighting the potentially serious consequences of successful exploitation.

Exploits

CVE-2026-88119 has not been publicly disclosed or reported as actively exploited.

Microsoft’s exploitability assessment indicates:

• Publicly Disclosed: No
• Exploited in the Wild: No
• Exploitability Assessment: Exploitation Less Likely
• Exploit Code Maturity: Unproven

There is no confirmed evidence of publicly available working exploit code, proof-of-concept (PoC) exploitation, or active zero-day attacks.

However, the vulnerability is technically exploitable.

An attacker could attempt exploitation by sending specially crafted network packets to the affected DHCP service.

The attack requires successfully triggering a race condition, which increases exploitation complexity.

The absence of known exploitation does not eliminate the risk of future attacks.

Technical Summary

CVE-2026-88119 is a Use-After-Free (CWE-416) vulnerability affecting the Windows DHCP Server service.

A Use-After-Free vulnerability occurs when software attempts to access memory after that memory has already been released.

This can create unsafe memory conditions that attackers may attempt to manipulate to execute malicious code.

In this case, an unauthenticated attacker could send a specially crafted packet over the network to a vulnerable Windows DHCP Server.

If the attacker successfully triggers the underlying memory management flaw, the vulnerability could allow remote code execution on the targeted system.

The attack has several important technical characteristics:

• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

A key technical challenge is that exploitation requires the attacker to win a race condition.

This means the attacker must successfully trigger specific timing-dependent operations within the vulnerable service.

Although this makes exploitation more difficult, it does not prevent a determined attacker from attempting to exploit the vulnerability.

Successful exploitation could allow malicious code to execute on the affected system, potentially compromising its security and availability.

Exploitability

The vulnerability affects the following Microsoft operating systems:

• Windows Server 2025
• Windows Server 2022
• Windows Server 2019
• Windows Server 2016
• Windows Server 2012 R2
• Windows Server 2012
• Windows 10 Version 1607 (x64)
• Windows 10 Version 1809 (32-bit and x64)

Both standard and Server Core installations are affected for the listed Windows Server versions.

An unauthenticated attacker could exploit the vulnerability remotely by sending specially crafted packets to an affected DHCP service.

No privileges or user interaction are required.

However, exploitation is considered less likely because the attacker must successfully win a race condition.

Business Impact

CVE-2026-88119 creates significant potential business risks because DHCP servers play an important role in maintaining network connectivity across enterprise environments.

A successful attack could compromise a critical infrastructure system and potentially disrupt essential business services.

Key business risks include:

• Network Disruption: Compromise of DHCP infrastructure could interrupt IP address allocation and affect connectivity for employees, applications, and devices.
• Operational Downtime: Disruption of critical network services could delay business activities and reduce productivity.
• Sensitive Data Exposure: Successful code execution could potentially expose confidential business information.
• Infrastructure Compromise: Attackers could potentially use a compromised server as a starting point for additional malicious activities.
• Financial Losses: Service interruptions, incident response, system recovery, and investigation activities could generate significant costs.
• Reputational Damage: Security incidents involving critical infrastructure could reduce customer and stakeholder confidence.

“When a DHCP server is compromised, the impact can extend far beyond one machine, potentially disrupting the network services an entire business depends on.”

Organizations relying heavily on Windows DHCP services should treat this vulnerability as an important infrastructure security risk.

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

The recommended action is to install the appropriate Microsoft security updates.

Relevant security updates include:

• Windows Server 2025: KB5126646
• Windows Server 2022: KB5126655
• Windows Server 2019: KB5126651
• Windows Server 2016: KB5126868
• Windows Server 2012 R2: KB5126836
• Windows Server 2012: KB5126835
• Windows 10 Version 1607: KB5126868
• Windows 10 Version 1809: KB5126651

If immediate patching is not possible, organizations can consider temporarily restricting network access to affected DHCP services to trusted systems where operationally feasible.

Such restrictions are general risk-reduction measures, not confirmed workarounds for this vulnerability.

A system restart is required after installing the applicable security update.

Urgency

Priority: Critical – Prioritize Deployment

CVE-2026-88119 should be prioritized for remediation because it affects critical Windows DHCP infrastructure and could allow unauthenticated remote code execution.

Although Microsoft assesses exploitation as less likely and there are currently no reported active exploits, several factors make timely patching important.

The vulnerability:

• Allows potential remote code execution over the network.
• Requires no authentication or user interaction.
• Affects multiple Windows Server versions, including Server Core installations.
• Has a CVSS base score of 8.1.
• Carries High confidentiality, integrity, and availability impacts.

The high attack complexity reduces the likelihood of successful exploitation but does not eliminate the threat.

Organizations should prioritize systems running affected DHCP services, particularly those supporting critical business operations.

“Attackers do not need a password or a user to click anything. A vulnerable DHCP service and a carefully crafted packet could be enough to put a critical server at risk.”

Deploy the applicable security updates through the organization’s accelerated patch management process, with appropriate testing and maintenance scheduling.