Windows Failover Clustering CVE-2026-96864

Exploitation requires the target Windows/Windows Server host to have the Failover Clustering role enabled so that the vulnerable Failover Cluster Virtual Driver is loaded and processing network traffic; standalone servers without clustering are not exposed. The attacker must have network reachability to the cluster communication path - in well-architected deployments this is a dedicated/isolated cluster interconnect, which materially limits remote reach despite the AV:N rating. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required once the driver is reachable. Affected builds include Windows Server 2012 through 2025 and Windows 10 (1607/1809), fixed in the patched builds listed in EUVD (e.g., Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650); unpatched clustered nodes are the realistic targets.

Signals are largely aligned toward high priority but with one important nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remote, unauthenticated, low-complexity code-execution flaw with total impact to confidentiality, integrity and availability - the classic 'critical, potentially wormable' profile, reinforced by CISA's SSVC assessment of Automatable=yes and Technical Impact=total. However, SSVC Exploitation is explicitly 'none' (no observed exploitation), the CVE is NOT in CISA KEV, and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be factored in - this is a missing signal that should be checked before final prioritization. The practical risk is also tempered by deployment reality: the vulnerable 'Failover Cluster Virtual Driver' is only active on Windows systems with the Failover Clustering role enabled, and cluster interconnects are frequently on isolated/dedicated networks, which narrows the realistic remote-attack surface below what the raw AV:N 9.8 implies. Net: treat as a genuine high-priority patch given automatable + total-impact + pre-auth kernel RCE, but note that the 9.8 likely overstates internet-facing exposure for most environments.

An attacker with access to the network segment carrying Windows Failover Cluster traffic sends specially crafted packets to a clustered Windows Server node, triggering a double free (CWE-415) in the Failover Cluster Virtual Driver. Because the flaw is in a kernel-mode driver and requires no authentication or user interaction (PR:N/UI:N), successful memory-corruption exploitation yields code execution at SYSTEM/kernel privilege. No public exploit code is referenced at the time of analysis, so reliable weaponization of the double free would require the attacker to develop the primitive.