Microsoft patches five critical Windows flaws rated CVSS 9.8

Microsoft’s November 2026 Patch Tuesday patched five critical Windows vulnerabilities in core network services, each rated CVSS 9.8 and affecting Kerberos, LDAP, DNS, DHCP Server and iSCSI. The article notes that all five require no login and no user interaction, meaning an attacker on the network could strike directly; CISA’s SSVC data lists exploitation as “none” and Microsoft rates exploit maturity as “Unproven,” though the vulnerabilities are described as automatable.

The flaws include CVE-2026-85844 (Kerberos), CVE-2026-119958 (LDAP), CVE-2026-88218 (DNS), CVE-2026-88243 (DHCP Server) and CVE-2026-88234 (iSCSI). The piece lists affected Windows versions as Windows Server 2016, 2019, 2022 and 2025 (including Server Core), Windows Server 2012/2012 R2 for the Kerberos issue, and Windows 10/11 clients across various builds.

Details of the vulnerabilities are: CVE-2026-85844 is an authentication bypass allowing privilege elevation across Windows Server 2012–2025 and Windows 10/11; CVE-2026-119958 is an out-of-bounds write in LDAP enabling remote code execution on Windows Server 2016+ and Windows 10/11; CVE-2026-88218 stems from a double free in DNS enabling code execution over the network; CVE-2026-88243 is an out-of-bounds read in DHCP Server leading to code execution on Windows Server 2016–2025; CVE-2026-88234 arises from an invalid pointer release in iSCSI, also permitting remote code execution.

The recommended practical response is to install the November 2026 cumulative updates first on domain controllers and DNS/DHCP/iSCSI servers, then to block these services at the network edge and verify that only trusted hosts can reach domain controllers.