{"id":"CVE-2026-105557","aliases":[],"cve":{"records":[{"id":"CVE-2026-105557","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-05T16:02:13.155Z","published":"2026-11-10T18:19:51.165Z","modified":"2026-11-13T18:08:40.812Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-11-13T18:08:40.812Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T21:11:08.683Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105557","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-497","description":"CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9688"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9688"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9487"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9487"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.20348.0","versionEndExcluding":"10.0.20348.5870"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33822"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33822"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T21:04:10.618767Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Windows DHCP Server Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Exposure of sensitive system information to an unauthorized control sphere in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.","score":5.9,"severity":"medium","published":"2026-11-10T18:19:51.165Z","modified":"2026-11-13T18:08:40.812Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Windows Server 2016","platforms":["x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9688","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-105557"},{"vendor":"Microsoft","name":"Windows Server 2016 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9688","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-105557"},{"vendor":"Microsoft","name":"Windows Server 2019","platforms":["x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9487","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-105557"},{"vendor":"Microsoft","name":"Windows Server 2019 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9487","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-105557"},{"vendor":"Microsoft","name":"Windows Server 2022","platforms":["x64-based Systems"],"versions":[{"version":"10.0.20348.0","status":"affected","lessThan":"10.0.20348.5870","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-105557"},{"vendor":"Microsoft","name":"Windows Server 2025","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33822","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-105557"},{"vendor":"Microsoft","name":"Windows Server 2025 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33822","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-105557"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105557"],"sources":[{"name":"CVE","id":"CVE-2026-105557","modified":"2026-11-13T18:08:40.812Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-105557"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":5.9}],"sourceAffected":[],"observedAt":"2026-11-13T18:21:11.802Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:25:32.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T07:45:35.751Z","attemptedAt":"2026-11-12T07:45:35.751Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T07:45:36.398Z","attemptedAt":"2026-11-12T07:45:36.398Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T07:45:36.390Z","attemptedAt":"2026-11-12T07:45:36.390Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T07:45:35.750Z","attemptedAt":"2026-11-12T07:45:35.750Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-105557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105557","modified":"2026-11-10T21:17:46.170","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-12T07:45:35.751Z"},{"source":"ENISA EUVD","id":"EUVD-2026-122043","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-122043","modified":"Nov 11, 2026, 5:15:15 PM","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","checkedAt":"2026-11-12T07:45:36.390Z"},{"source":"GitHub Advisory Database","id":"GHSA-xxf9-924m-m94j","url":"https://github.com/advisories/GHSA-xxf9-924m-m94j","modified":"2026-11-10T21:32:28Z","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-12T07:45:36.398Z"}],"aiSummary":{"text":"Windows DHCP Server versions 10.0.14393.0 to 10.0.14393.9688, 10.0.17763.0 to 10.0.17763.9487, 10.0.20348.0 to 10.0.20348.5870, and 10.0.26100.0 to 10.0.26100.33822 are affected by an information disclosure vulnerability, allowing unauthorized attackers to disclose sensitive system information over a network. The vulnerability is due to exposure of sensitive system information to an unauthorized control sphere.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T21:36:09.662Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-105557"}]}}