# CVE-2026-88216: Windows DHCP Server time-of-check time-of-use race condition

Source: https://junglewise.ai/threats/cve-2026-88216-time-of-check-time-of-use-toctou-race-condition-in-windows-dhcp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-88216 · Severity: high · CVSS 7.5 · Published 2026-11-10

Windows DHCP Server, which assigns network addresses to devices on corporate networks, contains a race condition vulnerability that allows an attacker with network access to execute code on the server. An attacker exploiting this flaw could gain full control of the DHCP infrastructure, enabling them to intercept network traffic or disrupt network services across an organization.

Technologies: [Microsoft Windows DHCP Server](https://junglewise.ai/threats/technologies/windows-dhcp-server). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-88216 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88216 being exploited in the wild.

**How severe is CVE-2026-88216?** High severity, with a CVSS score of 7.5, published 10 November 2026.

**Which products and versions are affected?** Microsoft Windows DHCP Server.

**Is there a fix for CVE-2026-88216?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88216 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-88216?** Check whether you run Microsoft Windows DHCP Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-of-check time-of-use (TOCTOU) race condition exists in Windows DHCP Server that allows an authorized attacker to execute arbitrary code via a network attack vector. The vulnerability permits an attacker to manipulate a resource between the time it is checked for validity and when it is actually used, resulting in remote code execution.

## Affected products

- Microsoft Windows DHCP Server

## Timeline

- 2026-11-10: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88216](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88216)

## Related threats

- [Microsoft Windows DHCP Server uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-96134-uncontrolled-resource-consumption-in-windows-dhcp-server-allows)
- [Microsoft Windows DHCP Server use-after-free remote code execution](https://junglewise.ai/threats/cve-2026-72998-use-after-free-in-windows-dhcp-server-allows-an-unauthorized)
- [Windows DHCP Server out-of-bounds read](https://junglewise.ai/threats/cve-2026-119890-out-of-bounds-read-in-windows-dhcp-server-allows-an-authorized)
- [Microsoft Windows DHCP Server improper access control](https://junglewise.ai/threats/cve-2026-113773-improper-access-control-in-windows-dhcp-server-allows-an)
- [Windows DHCP Server missing authentication in critical function](https://junglewise.ai/threats/cve-2026-105588-missing-authentication-for-critical-function-in-windows-dhcp)