CVE-2026-88243: Windows DHCP Server Remote Code Execution Vulnerability

CVE-2026-88243 PUBLISHED CVSS 9.8 CRITICAL

Windows DHCP Server Remote Code Execution Vulnerability

Reported by microsoft · Published November 10, 2026

Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Risk scores

CVSS 3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Vendor	Product	Versions
Microsoft	Windows Server 2016	10.0.14393.0
Microsoft	Windows Server 2016 (Server Core installation)	10.0.14393.0
Microsoft	Windows Server 2019	10.0.17763.0
Microsoft	Windows Server 2019 (Server Core installation)	10.0.17763.0
Microsoft	Windows Server 2022	10.0.20348.0
Microsoft	Windows Server 2025	10.0.26100.0
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0
microsoft	windows_server_2022	10.0.20348.0
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0
microsoft	windows_server_2025	10.0.26100.0
Microsoft	Windows Server 2019 (Server Core installation)	10.0.17763.0
Microsoft	Windows Server 2025	10.0.26100.0
Microsoft	Windows Server 2022	10.0.20348.0
Microsoft	Windows Server 2019	10.0.17763.0
microsoft	windows_server_2016	10.0.14393.0
Microsoft	Windows Server 2016	10.0.14393.0
Microsoft	Windows Server 2016 (Server Core installation)	10.0.14393.0
microsoft	windows_server_2019	10.0.17763.0

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-88243
vulnetix vdb fixes CVE-2026-88243

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-88243/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart