Critical Windows Kerberos, LDAP, DNS, DHCP and iSCSI Flaws Rated CVSS 9.8 Patched in November 2026

TL;DR

Microsoft’s November 2026 Patch Tuesday fixed five critical Windows vulnerabilities in core network services, each rated CVSS 9.8. They affect Kerberos, LDAP, DNS, the DHCP Server and iSCSI. All five need no login and no user interaction, so an attacker on the network can strike directly.

Five critical Windows vulnerabilities let unauthenticated attackers run code or gain privileges over the network. CISA’s assessment marks all five as “Automatable,” though none is exploited yet. Patch domain controllers, DNS and DHCP servers first.

Notable CVEs

Why It Matters

These services sit at the heart of a Windows network. For example, a Kerberos or LDAP takeover can hand an attacker the whole Active Directory domain. Likewise, DNS and DHCP servers talk to every device on the network.

Fortunately, Microsoft rates exploit maturity as “Unproven” for all five. CISA’s SSVC data in the CVE records also lists exploitation as “none.” Still, “Automatable” means attacks could spread quickly once someone builds a working exploit.

How the Attack Works

CVE-2026-85844: Windows Kerberos

This flaw is an “authentication bypass using an alternate path or channel.” As a result, an unauthorized attacker can “elevate privileges over a network.” It affects Windows Server 2012 through 2025, plus Windows 10 and 11.

CVE-2026-119958: Windows LDAP

An out-of-bounds write in LDAP lets an attacker run code remotely. It covers Windows Server 2016 and later, along with Windows 10 and 11.

CVE-2026-88218: Windows DNS

Here, the root cause is a double free. Microsoft says it “allows an unauthorized attacker to execute code over a network.”

CVE-2026-88243: Windows DHCP Server

Meanwhile, an out-of-bounds read in the DHCP Server leads to code execution. Only Windows Server 2016 through 2025 are affected.

CVE-2026-88234: Windows iSCSI

Finally, the iSCSI flaw stems from the release of an invalid pointer. It also allows remote code execution.

Affected Versions

• Windows Server 2016, 2019, 2022 and 2025, including Server Core
• Windows Server 2012 and 2012 R2 (Kerberos flaw)
• Windows 10 versions 1607, 1809, 21H2 and 22H2
• Windows 11 versions 23H2 through 26H2

Patch and Mitigation

Install the November 2026 cumulative updates, starting with domain controllers and servers running DNS, DHCP or iSCSI. Next, block these services at the network edge, since none should face the internet. Also check that only trusted hosts can reach domain controllers.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.