EUVD-2026-73775
GHSA-275q-g846-p5mh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network vector with full impact matches vendor, but reliably winning a use-after-free race for code execution typically raises complexity, so AC:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
Articles & Coverage 2
AnalysisAI
Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Windows Server (2019/2022/2025) or Windows 10 1809 host has the Failover Clustering feature installed and running, and that the attacker can reach the cluster's network communication endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are strongly aligned toward high real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes low-complexity, unauthenticated, network-reachable exploitation with total confidentiality, integrity, and availability loss, and the CWE-416 memory-corruption class combined with an RCE outcome is historically weaponizable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft's security update that raises affected systems to at least the fixed builds: Windows Server 2019 / Windows 10 1809 to 10.0.17763.9245, Windows Server 2022 to 10.0.20348.5622, and Windows Server 2025 to 10.0.26100.33438, per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73010 (Vendor-released patch: available from Microsoft). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all instances of Windows Server 2019, 2022, and 2025 with Failover Cluster enabled, plus Windows 10 Version 1809 systems in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today