CVE-2026-88120 – Windows DHCP Server Remote Code Execution Vulnerability

Microsoft has addressed a critical Remote Code Execution (RCE) vulnerability in Windows DHCP Server that could allow an unauthenticated attacker to execute malicious code remotely. The vulnerability, identified as CVE-2026-88120, results from a Use-After-Free memory management flaw. An attacker could exploit this weakness by sending a specially crafted network packet to an affected DHCP service. Although exploitation requires winning a race condition, making attacks more difficult, the vulnerability is particularly concerning because it requires no authentication or user interaction. Successful exploitation could compromise the confidentiality, integrity, and availability of affected systems.

CVSS SCORE: 8.1

SEVERITY: Critical

Threat

This vulnerability presents a significant security risk to organizations running affected Windows DHCP Server services.

An attacker with network access to a vulnerable DHCP service could potentially execute arbitrary code without requiring valid credentials or assistance from a legitimate user.

Successful exploitation could allow attackers to:

• Execute malicious code remotely on vulnerable systems.
• Compromise sensitive information stored or processed by affected servers.
• Modify or manipulate critical system configurations and data.
• Disrupt DHCP services and potentially affect network connectivity.
• Use a compromised server as a starting point for further malicious activity.

The vulnerability has a CVSS base score of 8.1, with high potential impact on confidentiality, integrity, and availability.

Although the attack complexity is rated High, the absence of authentication and user interaction requirements makes this vulnerability a serious concern for organizations operating affected DHCP services.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication, the vulnerability was not publicly disclosed and had not been reported as exploited in the wild.

The exploit code maturity is classified as Unproven, meaning the existence of functional public exploit code or proof-of-concept (PoC) exploitation has not been confirmed.

There is also no confirmed evidence of this vulnerability being actively exploited as a zero-day.

However, the vulnerability could potentially be exploited remotely by an unauthenticated attacker.

Successful exploitation requires an attacker to win a race condition, which increases the technical difficulty of developing a reliable exploit.

Despite this complexity, organizations should not underestimate the potential impact of a successful attack.

Technical Summary

CVE-2026-88120 is a Use-After-Free (CWE-416) vulnerability affecting the Windows DHCP Server service.

A Use-After-Free vulnerability occurs when software continues to access memory after that memory has already been released.

This can create unsafe memory conditions that attackers may attempt to manipulate to execute malicious code.

In this case, an unauthenticated attacker could exploit the vulnerability by sending a specially crafted network packet to an affected Windows DHCP Server service.

The vulnerability involves a race condition, meaning successful exploitation depends on the attacker triggering specific operations at the right moment.

This requirement increases the attack complexity and makes exploitation less predictable.

However, if the attacker successfully manipulates the vulnerable memory condition, the attack could result in remote code execution on the targeted system.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The combination of remote accessibility and the absence of authentication requirements makes this vulnerability particularly important for organizations operating DHCP services.

Microsoft has released an official security fix to address the vulnerability.

Exploitability

The vulnerability affects the following Microsoft operating systems:

• Windows Server 2012 and 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025
• Windows 10 Version 1607 (x64)
• Windows 10 Version 1809 (32-bit and x64)

Affected Windows Server versions include Server Core installations.

An attacker could exploit the vulnerability by sending specially crafted network packets to an affected DHCP service.

Successful exploitation requires winning a race condition, but no privileges or user interaction are required.

Microsoft rates exploitation as Less Likely.

Business Impact

A successful attack against a vulnerable Windows DHCP Server could have serious consequences for organizations that depend on these systems for network operations.

DHCP servers play an important role in assigning IP addresses and supporting network connectivity across enterprise environments.

Compromising a DHCP server could expose organizations to several business risks.

1. Critical Server Compromise

Successful exploitation could allow attackers to execute malicious code on affected systems, potentially compromising important server resources.

2. Business Service Disruption

An attack affecting DHCP server availability could interfere with IP address allocation and disrupt network connectivity for employees, applications, and business systems.

3. Sensitive Information Exposure

The vulnerability has a High confidentiality impact, meaning successful exploitation could potentially expose sensitive information accessible from the compromised system.

4. Unauthorized System Changes

Attackers could potentially modify system configurations, manipulate information, or interfere with server operations following successful code execution.

5. Increased Risk of Further Attacks

A compromised DHCP server could potentially provide attackers with an opportunity to conduct additional malicious activities within the organization’s network.

“When a critical network service is compromised, the damage may extend far beyond one server, potentially affecting the connectivity and security of the entire business.”

Organizations should prioritize protecting DHCP infrastructure to reduce the likelihood of operational disruption and security incidents.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

The recommended remediation is to install the applicable Microsoft security updates.

If immediate patching is not possible, organizations can consider temporarily restricting network access to DHCP services to authorized network segments, where operationally feasible.

These restrictions are general risk-reduction measures and are not confirmed fixes for the vulnerability.

A system restart is required after installing the applicable security update.

Urgency

Critical Severity – Prioritize Security Update Deployment

CVE-2026-88120 should receive high patching priority because it affects Windows DHCP Server and could allow unauthenticated remote code execution.

Although Microsoft considers exploitation less likely and has not reported active exploitation, the vulnerability presents a significant risk due to its potential impact on critical network infrastructure.

The most concerning factor is that an attacker does not need credentials or user interaction to attempt exploitation.

A successful attack could compromise affected servers, expose sensitive information, and disrupt essential network services.

Organizations should prioritize deploying the applicable Microsoft security updates, particularly on DHCP servers supporting critical business operations.

Testing and deployment should account for the required system restart to minimize potential service interruptions.

“A difficult attack is not an impossible attack. Patching critical DHCP vulnerabilities before attackers exploit them is essential to keeping business networks secure.”