EUVD-2026-99653
GHSA-8vp3-xxj6-qx5c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach cluster service over network
-
DeliverySend crafted cluster messages
-
ExploitTrigger use-after-free in handler
-
ExecutionCorrupt freed object memory
-
ImpactExecute code on cluster node
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Windows Failover Clustering role/feature to be installed and running, and the cluster service's network interface must be reachable by the attacker - this is not a default Windows Server configuration. No authentication is needed (CVSS PR:N, UI:N). Exploitation is limited in practice because failover clusters typically communicate over segmented, trusted management/heartbeat networks rather than exposed public interfaces, and reliably weaponizing a CWE-416 use-after-free generally demands precise timing to control the freed object. Affected builds: Windows Server 2019 (<10.0.17763.9376), Server 2022 (<10.0.20348.5761), and Server 2025 (<10.0.26100.33650), including Server Core installations. |
| Impact | Signals diverge sharply and that divergence is the headline. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - unauthenticated network remote code execution with total CIA impact. CWE-416 (use after free) plus SSVC Technical Impact: total and Automatable: yes reinforce a worst-case severity ceiling. HOWEVER, the SSVC Exploitation state is 'none', no CISA KEV listing is present in the input, no POC is indicated, and no EPSS score was provided - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical mitigating factor is the attack surface: Windows Failover Cluster is a specific server role, not a default-enabled service, and cluster intra-node traffic normally rides trusted management/heartbeat networks rather than the open internet. Net read: this is a genuine high-severity patch-now item for organizations running failover clusters, but the raw 9.8 overstates ubiquity of exposure - real risk concentrates on datacenter/HA deployments with reachable cluster networks, not every Windows Server. EPSS is missing, so widespread-scanning likelihood cannot be quantified from the data. |
| Exploit ScenarioDerived | An attacker with network access to a node's cluster communication interface sends crafted messages to the Failover Clustering service, triggering a use-after-free in the handling of that traffic. Reliable exploitation of the freed-object condition typically requires winning a timing/race window, after which the attacker corrupts memory to execute code in the privileged cluster service context. No public exploit code is identified at time of analysis, and no authentication is required per the CVSS vector (PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote code execution is possible against Windows Failover Cluster through a use-after-free in the cluster service, affecting Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations, whenever the Failover Clustering role is installed and running. Signals diverge sharply: Microsoft and NVD publish a 9.8 score with AV:N/AC:L/PR:N/UI:N, while the independent assessment re-scores attack complexity as High (AC:H) because the clustering role is not a default configuration, the service normally lives on segmented management/heartbeat networks rather than exposed public interfaces, and reliably converting a freed object into controlled execution requires precise timing. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" while rating the flaw fully automatable with total technical impact if the service is reachable; if that reachability exists, impact is complete loss of confidentiality, integrity, and availability.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88102, which per the EUVD build ranges remediates affected systems to Windows Server 2019 build 10.0.17763.9376 or later, Windows Server 2022 build 10.0.20348.5761 or later, and Windows Server 2025 build 10.0.26100.33650 or later (Server Core installations must be updated to the same corresponding builds). Because patching failover clusters usually requires rolling node updates, prioritize nodes whose cluster service interfaces are reachable from less-trusted networks. If immediate patching is not possible, the actionable compensating controls are network-based rather than code-based: block inbound reachability to the cluster service's network interface from any segment other than the dedicated cluster heartbeat/management network, using host firewall rules or network ACLs - the trade-off is that this can break cross-subnet or stretched-cluster communication and must be validated against your cluster's node-to-node topology before enforcement. Where the Failover Clustering role is installed but not actively used, remove the role to eliminate the attack surface entirely, accepting that clustered workloads hosted on that node will need to be relocated. Restricting the cluster network to authenticated management hosts does not remove the flaw - the assessed vector is PR:N, so any reachable unauthenticated packet path is sufficient - and monitoring for cluster service crashes (the use-after-free can manifest as a denial-of-service symptom) provides only detection, not prevention. Apply the vendor patch as the primary and definitive fix; no public exploit code has been identified at time of analysis, so the urgency driver is the total technical impact and full automatability recorded by SSVC rather than observed exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, a use-after-free in the Windows Failover Clustering service, which manages cluster membership, quorum, and resource state across nodes and exchanges that state over the network. A use-after-free means the service frees a heap object and then dereferences it again - typically when handling a crafted network request - letting an attacker who can control the freed region's contents influence what the stale pointer accesses; this class of bug commonly leads to memory corruption, crashes (hence the Denial of Service tag alongside Memory Corruption in the vendor metadata), or, with sufficient heap grooming and timing control, arbitrary code execution in the context of the cluster service. The affected components are the Windows Server failover clustering stack on builds 10.0.17763 (Server 2019), 10.0.20348 (Server 2022), and 10.0.26100 (Server 2025), including Server Core variants that still ship the optional clustering feature. Note the scoring split between sources: the published CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H implies trivial remote exploitation, whereas the independent assessment's AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that attack complexity, not reachability requirements, is the binding constraint. CISA's SSVC decision points (Exploitation: none, Automatable: yes, Technical Impact: total) reinforce that the flaw is mechanically exploitable in principle but has not been observed exploited in practice; ENISA's EUVD-2026-99653 entry mirrors the same build ranges, and the reporter is Microsoft's own security team (secure@microsoft.com).
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable cluster service with no auth (AV:N/PR:N), but use-after-free exploitation requires a race/timing window and the clustering feature enabled, so AC:H; full RCE gives C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A critical unauthenticated remote code execution vulnerability in the Windows Failover Cluster service affects Windows Server 2019, Windows Server 2022, and Windows Server 2025 installations, including Server Core, wherever the Failover Clustering role is installed. Organizations using clustered Windows Server infrastructure for high availability could face full compromise of affected nodes if the cluster service is reachable, so leadership should prioritize exposure review and patching. No public exploit identified at time of analysis, and Patch available per vendor advisory.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB