Microsoft has fixed a critical flaw in Windows DNS, CVE-2026-88218, scored 9.8 out of 10, that lets an attacker run code on a Windows machine over a network without logging in and without the victim clicking anything. The flaw was patched on 10 November 2026 as part of Microsoft's November Patch Tuesday.

The flaw is a double-free memory error, listed as CWE-415. In plain terms, the Windows DNS software frees the same block of memory twice, and an attacker can exploit that mistake to run their own code. The United States National Vulnerability Database describes it in one line: a double free in Windows DNS allows an unauthorised attacker to execute code over a network. The severity score reflects how easy the attack is: it works over the network, it is low complexity, and it needs no privileges and no user interaction. All three impacts, confidentiality, integrity and availability, are rated high.

Which systems are affected?

The flaw affects a very wide range of Windows versions. According to the National Vulnerability Database, affected systems include Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2016, 2019, 2022 and 2025. In practice that covers almost every supported Windows computer, from office desktops to the servers that run company networks. The fix ships in the normal November cumulative update for each Windows version, so there is no separate download to hunt for.

What to do now

Apply the November 2026 cumulative update and restart the machine when the update asks for it. Servers should come first, because they are reachable on the network around the clock, but desktops should not be left behind, since this flaw sits in Windows itself rather than in a server-only role. The flaw had not been flagged as exploited when the patch shipped, but a 9.8 score with no login and no click needed is exactly the kind of flaw attackers study first. Microsoft fixed 1,093 flaws in this month's release, 63 of them critical, and only one, the Outlook spoofing flaw CVE-2026-124194, was marked as actively exploited. That does not make the rest safe to ignore. NVD and Senserva both list CVE-2026-88218 among the highest-risk fixes in the November release.

Frequently asked questions

Is CVE-2026-88218 being exploited? No. Microsoft had not flagged it as exploited when the patch was released on 10 November 2026. That can change quickly, which is why patching promptly matters.

Does the attacker need a password? No. The CVSS vector for this flaw is network access, low complexity, no privileges required and no user interaction required. The attacker only needs to be able to reach the affected Windows DNS component over the network.

Which update fixes it? The November 2026 cumulative update for your version of Windows. Install it through Windows Update and restart when prompted.