The asset you didn’t pentest is the one attackers exploit. See 5 real attack chains 5 real attack chains

(CVE-2026-88243) Windows DHCP Server Remote Code Execution via Out-of-Bounds Read

9.8 | Critical November 11, 2026

An out-of-bounds read in the Windows DHCP Server service lets an unauthenticated attacker execute code over the network, enabling full takeover of affected Windows Server hosts.

9.8 | Critical

Vulnerability Notice: Patch CVE-2021-31166

May 21, 2021 Research post