Windows Failover Cluster EUVD-2026-100347

Exploitation requires the target Windows Server to have the Failover Clustering role/feature installed and active, and the attacker must have network reachability to the cluster service's communication interface. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are required once that reachability exists. Limiting factors: standalone (non-clustered) Windows servers are not affected; cluster inter-node traffic is commonly confined to isolated/management or heartbeat networks, so exposure typically depends on an attacker already having a foothold on or route to that network segment rather than direct internet exposure.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with impact confined entirely to availability (C:N/I:N) - a pure denial-of-service, consistent with CWE-191 (integer underflow) corrupting state in the Failover Cluster service. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis and no quantitative exploitation-probability signal to weigh. The SSVC decision inputs (exploitation status, automatable, technical impact) are not supplied in the data. On raw metrics this is a legitimately high-scoring issue, but real-world priority is tempered by exposure scope: the vulnerable code path exists only on servers with the Windows Failover Clustering role enabled, and cluster intra-node communication is typically restricted to trusted/management networks rather than exposed to the internet, which narrows the realistic attacker population despite the AV:N rating. Note also a tagging conflict: the input Tags include 'Authentication Bypass' and 'Integer Overflow,' but the description and CWE-191 describe an integer UNDERFLOW causing DoS with no confidentiality/integrity impact - the 'Authentication Bypass' tag is inconsistent with C:N/I:N and should be disregarded. Net: a credible availability risk for clustered Windows Server estates, not a confirmed widespread-exploitation emergency; patch on normal-to-expedited cadence for HA infrastructure.

A remote, unauthenticated attacker with network reachability to a Windows Server node running the Failover Clustering role sends a specially crafted message to the cluster service, triggering an integer underflow that corrupts internal state and crashes or hangs the service. This degrades or takes down the clustered workload's availability. No public proof-of-concept is available, and the low attack complexity (AC:L) means no special timing or race conditions are required once the attacker can reach the cluster communication path.