Windows Failover Cluster CVE-2026-88099

Exploitation requires the target to be running the Windows Failover Clustering feature/role (not enabled in default standalone Windows Server installations) with the cluster's network interface reachable by the attacker. Affected builds are Windows Server 2019 (<10.0.17763.9376), 2022 (<10.0.20348.5761), and 2025 (<10.0.26100.33650), including Server Core installations. No authentication or user interaction is needed (PR:N/UI:N), but the HIGH attack complexity (AC:H) means the attacker must satisfy a specific race or state condition outside their direct control to trigger the uncaught exception, which materially limits reliable exploitation and matches SSVC Automatable=no.

This is a moderate-priority network denial-of-service issue, not a critical emergency. The CVSS 3.1 base score is 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - reachable over the network with no authentication or user interaction, but gated by HIGH attack complexity, and limited to an availability impact (C:N/I:N) consistent with CWE-248 (uncaught exception). All risk signals align toward LOW real-world urgency: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be factored in - this is a data gap, not a low score. The AC:H metric is the key mitigating signal: triggering the uncaught exception realistically requires winning a race or meeting a specific state the attacker does not control, which is consistent with SSVC Automatable=no. Net: a legitimate patch-in-normal-cycle item for environments running Windows Failover Clustering, not a drop-everything issue. Note one input inconsistency to verify: the 'Authentication Bypass' tag contradicts the description (a DoS via uncaught exception) and the vector (no integrity/confidentiality impact).

An attacker with network reachability to a Windows Failover Cluster node sends specially crafted traffic to the clustering service and triggers an unhandled exception, crashing the service and denying availability of the clustered workload. No authentication or user interaction is required (PR:N/UI:N), but the HIGH attack complexity means the attacker must meet specific timing or state conditions to reliably trigger the fault. No public exploit code has been identified at time of analysis.