What is CVE-2026-88243?
CVE-2026-88243 is an out-of-bounds read vulnerability in the Windows DHCP Server service that allows an unauthenticated attacker to execute code over a network. Microsoft addressed it in its November 2026 security updates.
The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). Exploitation is pre-authentication. The attacker needs no privileges, no credentials, and no user interaction, and attack complexity is rated low.
Successful exploitation results in remote code execution on the affected server, with high impact to confidentiality, integrity, and availability. In practice, that means control of a host that often sits close to core directory and network infrastructure.
At the time of writing, the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof of concept has been reported. Some researchers have grouped it with this month’s potentially wormable network bugs, given its unauthenticated, no-interaction attack path.
What assets are affected by CVE-2026-88243?
The CNA advisory lists Windows Server 2016 and Windows Server 2019, including Server Core installations, along with Windows Server 2022 and Windows Server 2025. Vulnerable builds are those below 10.0.14393.9688 (2016), 10.0.17763.9487 (2019), 10.0.20348.5870 (2022), and 10.0.26100.33822 (2025).
The flaw sits in the DHCP Server service, so the hosts in scope are Windows servers with the DHCP Server role installed. These are typically infrastructure servers in data centers, branch offices, and lab environments, often running alongside domain controller or DNS roles. DHCP traffic normally runs over UDP/67.
DHCP servers are not meant to face the internet. When they do, it is usually the result of drift: permissive cloud security groups, flat network segments, VPN or partner links that extend internal networks, and legacy servers that were built years ago and never revisited. NVD analysis for this CVE is still pending, so some vulnerability databases may not yet reflect the full affected range.
What does our data show about exposure patterns?
Exposure in this set is led by Industrials at 29.2% of observed assets, with Health Care contributing 15.0% and Consumer Discretionary 12.7%. The set covers externally reachable assets observed running Windows Server, predominantly identified by service fingerprint rather than by confirmed version detection. These assets are potentially affected, and whether the DHCP Server role is enabled on them cannot be determined from the outside.
Industrials organizations, which include commercial and professional services firms, tend to run large, distributed Windows estates that support field operations, client portals, and shared services. Many of those servers were built for internal use and later exposed through acquisitions, outsourcing, or partner access. Health Care follows a similar pattern, where clinical and administrative systems often depend on Windows Server builds tied to vendor certification, which slows upgrades.
Across sectors, the pattern points less to any one industry and more to how Windows infrastructure ages. Servers that started as internal infrastructure become reachable from the internet through incremental changes that no one tracks as a whole. The large Others share, which includes organizations without a sector classification, reinforces that this exposure is broad rather than sector-specific.
Are fixes available?
Yes. Microsoft released fixes in its November 2026 Patch Tuesday updates for Windows Server 2016, 2019, 2022, and 2025. Based on the CNA advisory, patched systems should report builds at or above 10.0.14393.9688 (2016), 10.0.17763.9487 (2019), 10.0.20348.5870 (2022), and 10.0.26100.33822 (2025).
The update package differs by Windows Server version and installation type. Older Windows Server 2016 hosts are the most likely to have fallen out of the regular patch cycle and deserve a direct check.
Defenders should confirm the correct update for each server build in the Microsoft Security Update Guide rather than assuming a fix is installed.
Are there any other recommended actions to take?
Until patching is confirmed, defenders should:
- Inventory Windows servers running the DHCP Server role across all environments
- Block inbound UDP/67 from untrusted networks at the perimeter
- Audit cloud security groups for rules that expose DHCP traffic
- Remove the DHCP Server role from servers that no longer need it
- Monitor DHCP Server event logs for crashes or unexpected service restarts
- Restrict DHCP relay paths to known, trusted network segments
How can CyCognito help your organization?
CyCognito published an Emerging Threat Advisory for CVE-2026-88243 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.
To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.
