CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Microsoft November 2026 Patch Tuesday: seven unauthenticated network flaws rated CVSS 9.8 in domain infrastructure, among them a Kerberos relay to a domain controller (CVE-2026-85844) and zero-clic...

cve · CVE-2026-88218

Coverage
1
first 2026-11-11 → last 2026-11-11
Latest activity
2026-11-11
Patch Tuesday: Kerberos relay to a DC and Exchange zero-click RCE lead the 9.8 server rows; none exploited
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
9
2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-88218, newest first. Check the date before acting on an older one.

  • Install the November 2026 cumulative update on every domain controller and every Exchange server first, then on DNS, DHCP and SQL Server hosts, because the Kerberos relay ends in SYSTEM on a domain controller and the Exchange flaw runs code from an inbound mail attachment that nobody has to open.
    2026-11-11CVE-2026-85844 +6

Defender insights

What each entry about CVE-2026-88218 tells a defender to do, newest first.

2026-11-11NOTABLEPatch Tuesday: Kerberos relay to a DC and Exchange zero-click RCE lead the 9.8 server rows; none exploited

Exposure · detection

Story timeline

  1. 2026-11-11Microsoft November 2026 Patch Tuesday: seven of the unauthenticated network flaws rated CVSS 9.8, in domain infrastructure and server roles, among them a Kerberos relay to a domain controller (CVE-2026-85844) and zero-click code execution through Exchange attachment indexing (CVE-2026-116928); none exploited or disclosed
    trending-vulnerabilitiesPatch Tuesday: Kerberos relay to a DC and Exchange zero-click RCE lead the 9.8 server rows; none exploited

Hunting pivots

Affected products
Microsoft Exchange ServerMicrosoft SQL ServerMicrosoft Windows Server
Tags
auth-bypasspatch-availablepre-authrcevulnerabilitieszero-click
ATT&CK techniques (3 across 4 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Credential AccessAdversary-in-the-Middle
  • Lateral MovementExploitation of Remote Services
  • CollectionAdversary-in-the-Middle

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-11/microsoft-november-2026-patch-tuesday-preauth-9-8-rows · ATT&CK page ↗

Credential Access TA0006

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-11-11/microsoft-november-2026-patch-tuesday-preauth-9-8-rows · ATT&CK page ↗

Lateral Movement TA0008

T1210Exploitation of Remote Services×1

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-11-11/microsoft-november-2026-patch-tuesday-preauth-9-8-rows · ATT&CK page ↗

Collection TA0009

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-11-11/microsoft-november-2026-patch-tuesday-preauth-9-8-rows · ATT&CK page ↗

Entries about Microsoft November 2026 Patch Tuesday: seven unauthenticated network flaws rated CVSS 9.8 in domain infrastructure, among them a Kerberos relay to a domain controller (CVE-2026-85844) and zero-clic... (1)

2026-11-11 · view entry permalink →

NOTABLECVE-2026-85844 +6NATOA2

Microsoft November 2026 Patch Tuesday: seven of the unauthenticated network flaws rated CVSS 9.8, in domain infrastructure and server roles, among them a Kerberos relay to a domain controller (CVE-2026-85844) and zero-click code execution through Exchange attachment indexing (CVE-2026-116928); none exploited or disclosed

Microsoft's November 2026 Patch Tuesday fixes seven flaws in domain infrastructure and server roles scored CVSS 3.1 9.8 that need no credentials over the network (the release carries further 9.8 rows, DirectMusic among them, that are not covered here (Microsoft, 2026-11-10)); the only record Microsoft marks as exploited in this release is the Outlook zero-day, which is a separate item, and none of these rows is marked exploited or publicly disclosed (Microsoft, 2026-11-10; BleepingComputer, 2026-11-10). Two have mechanics that make the timeline short. CVE-2026-85844 is an authentication bypass in Windows Kerberos: an unauthenticated attacker sends crafted Kerberos authentication traffic and relays the resulting authentication to an affected domain controller, with no user interaction (Microsoft, 2026-11-10). CVE-2026-116928 is an out-of-bounds write in the Windows Search component that Exchange Server uses: an attacker emails a crafted attachment, Exchange indexes it automatically, so "the recipient does not need to open the email or attachment", and the code runs with the permissions of the processing service (Microsoft, 2026-11-10).

The other five are described more thinly: a double free in Windows DNS (CVE-2026-88218) (Microsoft, 2026-11-10), an out-of-bounds read in Windows DHCP Server (CVE-2026-88243) (Microsoft, 2026-11-10) and a release of an invalid pointer in Windows iSCSI (CVE-2026-88234) (Microsoft, 2026-11-10), each reachable by an in-network attacker calling arbitrary endpoints; an out-of-bounds write in the Windows LDAP service that gives code execution in its context through crafted LDAP calls (CVE-2026-119958) (Microsoft, 2026-11-10); and a heap overflow in SQL Server (CVE-2026-116945) that needs an attacker who controls a network endpoint an integration package connects to, with no credentials or user interaction when the package runs automatically (Microsoft, 2026-11-10). The fixes are the November cumulative updates per release, for example KB5131291 (Windows Server 2016), KB5131085 (Server 2019), KB5131090 (Server 2022) and KB5131080 or KB5131077 (Server 2025), and the November SQL Server updates, for example KB5129299 (2025 CU10) and KB5129300 (2022 CU27).

An unauthenticated attacker could send specially crafted Kerberos authentication traffic and relay the resulting authentication to an affected domain controller.

Exchange automatically processes the attachment for indexing, so the recipient does not need to open the email or attachment.

Double free in Windows DNS allows an unauthorized attacker to execute code over a network.

An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through a specially crafted set of LDAP calls to execute arbitrary code within the context of the LDAP service.

The attacker does not need SQL Server credentials or additional user interaction when the package runs automatically.

Microsoft
vulnerability11 Nov 03:37Zmulti-sourceOpen finding →
Sources: Microsoft (Security Update Guide, CVE-2026-85844) · Microsoft (Security Update Guide, CVE-2026-116928) · Microsoft (Security Update Guide, CVE-2026-88218) · Microsoft (Security Update Guide, CVE-2026-119958) · Microsoft (Security Update Guide, CVE-2026-88243) · Microsoft (Security Update Guide, CVE-2026-88234) · Microsoft (Security Update Guide, CVE-2026-95882) · Microsoft (Security Update Guide, CVE-2026-116945) · BleepingComputer

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • msrc.microsoft.com8 (89%)
  • bleepingcomputer.com1 (11%)

External references

NVD · cve.org · CISA KEV

All cited sources (9)