Microsoft Windows Server DHCP Server: Remote Code Execution

Summary

A flaw in the DHCP Server role of Windows Server allows code execution on the affected server over the network. The CVE record classifies it as a release of an invalid pointer or reference (CWE-763) and a heap-based buffer overflow (CWE-122). An attacker needs high privileges on the network before exploitation, so the risk is mainly lateral movement from a compromised administrator account or an internal foothold.

Affected

• Windows Server 2016 and Server Core installation: 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 and Server Core installation: 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870 (listed only in the Strix mirror, not verified at MSRC)
• Windows Server 2025 and Server Core installation: 10.0.26100.0 to before 10.0.26100.33822 (listed only in the Strix mirror, not verified at MSRC)
• Windows client editions: Unknown.

Fixed in

• Windows Server 2016 (incl. Server Core): 10.0.14393.9688
• Windows Server 2019 (incl. Server Core): 10.0.17763.9487
• Windows Server 2022: 10.0.20348.5870 (to be verified at MSRC)
• Windows Server 2025 (incl. Server Core): 10.0.26100.33822 (to be verified at MSRC)
• KB numbers: Unknown. See the MSRC advisory.

Workaround

Unknown. No workaround was found in the sources reviewed. Applying the fixed build is the only documented remedy.

Exploitation

• No confirmed exploitation or public proof of concept was found.
• The CVSS temporal vector reflects low exploit maturity (E:U).
• CISA SSVC: Exploitation none, not automatable, total technical impact.
• Rapid7 reports that Microsoft is aware of in-the-wild exploitation of one vulnerability from its November 2026 Patch Tuesday but does not name it. Whether this CVE is that vulnerability is unconfirmed.

Our recommendation

• Inventory all Windows Server 2016, 2019, 2022 and 2025 systems with the DHCP role, including Server Core.
• Install the November 2026 cumulative update or at least the build listed for your version. Confirm the builds for 2022 and 2025 at MSRC first.
• Plan a maintenance window, as DHCP is often hosted on a domain controller or file server.
• Restrict DHCP administrator rights and verify that the DHCP server is not reachable from user VLANs, guest networks or branch sites.
• Recheck NVD and MSRC in a few days for updated exploitation status and workaround guidance.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105560 msrc.microsoft.com
• CVE Record (Microsoft CNA): CVE-2026-105560 www.cve.org
• Strix mirror: CVE-2026-105560 (version rows for 2022 and 2025) www.strix.ai
• Rapid7: Patch Tuesday November 2026 www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:51.