CVE-2026-105588: Windows DHCP Server Elevation of Privilege Vulnerability

Vulnerability Overview and Official Metrics​

At the core of CVE-2026-105588 is an authentication weakness cataloged under CWE-306. According to the official Microsoft Security Response Center (MSRC) description:

Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

Click to expand...

To help administrators prioritize their patch management queues, Microsoft provides the following official metrics and status indicators for CVE-2026-105588:

• Title: Windows DHCP Server Elevation of Privilege Vulnerability
• CVE ID: CVE-2026-105588
• Severity: Important
• CVSS Base Score: 6.4
• CVSS Temporal Score: 5.6
• CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness (CWE): CWE-306
• Publicly disclosed: No
• Exploited: No
• Exploitation Assessment: Exploitation Less Likely
• Customer action required: Yes

Summary of Metrics​

The vulnerability carries a 6.4 CVSS base score and a 5.6 temporal score. With no public disclosure (Publicly disclosed: No), no in-the-wild exploitation (Exploited: No), and an assessment of Exploitation Less Likely, it is not a hair-on-fire zero-day, but because Customer action required: Yes applies, server administrators must schedule the appropriate updates during their maintenance windows.

Technical Analysis: How the Flaw Works​

Why does a local elevation of privilege vulnerability in a network service carry both a high privilege requirement (PR:H) and high attack complexity (AC:H)? The official advisory facts break down the exact mechanics and constraints an attacker faces when attempting to abuse CVE-2026-105588:

• Windows DHCP Server Elevation of Privilege Vulnerability: Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
• What could an attacker do by exploiting this vulnerability? An attacker who successfully exploited this vulnerability could change protected registry settings with the permissions of the Network Service account.
• According to the CVSS metric, attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation requires a specially prepared configuration to be processed when the affected service restarts or the system reboots. The attacker must wait for that service-lifecycle event, which is not reliably under their control.

From a practical Windows Server engineering standpoint—synthesizing general industry knowledge of Windows service architecture alongside Microsoft's advisory facts—this scenario illustrates how subtle service-boundary flaws operate. Even when an attacker already possesses elevated local privileges (PR:H) on a host, Windows isolates service-specific registry keys and operational state so that only the designated service identity, such as the Network Service account, can modify certain protected registry settings. By preparing a malicious configuration and waiting for the Windows DHCP Server service to restart or the operating system to reboot, the attacker tricks the service into applying unauthorized changes to protected registry settings under the permissions of the Network Service account. Because the attacker cannot reliably force that service-lifecycle event on demand, the attack complexity is rated high (AC:H).

Summary of Technical Impact​

Exploitation is strictly local (AV:L), requires no user interaction (UI:N), and demands that an authorized attacker stage a specially prepared configuration and wait for a service restart or system reboot to modify protected registry settings using the permissions of the Network Service account.

Affected Products, KB Articles, and Fixed Builds​

This vulnerability spans standard and Server Core x64 installations of Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Below is the complete, verified mapping of affected products, Knowledge Base (KB) updates, and vendor fixed build numbers:

Official Remediation Guidance​

To resolve CVE-2026-105588, administrators should deploy the exact security updates matching their Windows Server edition and installation type:

• For Windows Server 2016 (Server Core installation) (x64), install KB5131291 to reach fixed build 10.0.14393.9688.
• For Windows Server 2016 (x64), install KB5131291 to reach fixed build 10.0.14393.9688.
• For Windows Server 2019 (Server Core installation) (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
• For Windows Server 2019 (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
• For Windows Server 2022 (Server Core installation) (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
• For Windows Server 2022 (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
• For Windows Server 2025 (Server Core installation) (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.
• For Windows Server 2025 (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.

Practical Deployment Takeaways​

notice that Windows Server 2025 environments—both standard (x64) and (Server Core installation) (x64)—have two listed update paths: KB5131077 (reaching fixed build 10.0.26100.33730) and KB5131080 (reaching fixed build 10.0.26100.33822). Meanwhile, earlier server releases each map to a single update package (KB5131291 for Windows Server 2016, KB5131085 for Windows Server 2019, and KB5131090 for Windows Server 2022). Because applying these updates involves rebooting your servers—ironically the exact lifecycle event discussed in the vulnerability's attack complexity breakdown—auditing your DHCP servers and verifying that their build numbers match the fixed versions above after reboot will ensure your infrastructure remains secure.