Windows Failover Cluster CVE-2026-73010

Exploitation requires that the target Windows Server (2019/2022/2025) or Windows 10 1809 host has the Failover Clustering feature installed and running, and that the attacker can reach the cluster's network communication endpoints. No authentication, privileges, or user interaction are needed (PR:N/UI:N), so any host on a network segment where cluster/RPC traffic is reachable is exposed. The primary limiting factors are that Failover Clustering is not enabled by default (only clustered deployments are vulnerable) and that cluster interconnect traffic is frequently - though not always - confined to an isolated management or heartbeat network, which reduces the exposed attack surface.

The signals are strongly aligned toward high real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes low-complexity, unauthenticated, network-reachable exploitation with total confidentiality, integrity, and availability loss, and the CWE-416 memory-corruption class combined with an RCE outcome is historically weaponizable. Tempering factors: this is not on CISA KEV and no public POC is indicated, so it is 'no public exploit identified at time of analysis' rather than confirmed in-the-wild activity, and Failover Cluster is a role rather than a default-on service, so exposure is limited to organizations actually running clusters and to networks where the cluster/RPC ports are reachable by an attacker. Because failover clusters underpin critical databases and virtualization, any organization from a global enterprise down to a mid-sized municipal IT team in gdynia running clustered Windows Server should treat this as urgent and patch promptly, ideally isolating cluster interconnect traffic to a trusted management segment in the interim. EPSS was not provided, so probabilistic exploitation likelihood could not be factored in.

An attacker with network reachability to a Windows Failover Cluster node sends specially crafted cluster network messages that trigger the use-after-free, corrupting service memory to hijack execution and run attacker code without any credentials or user interaction. From a single compromised cluster node the attacker can pivot to the clustered workloads (databases, virtual machines, file services) the cluster hosts. No public POC is currently identified, but the low attack complexity makes reliable exploitation feasible once technical details circulate.