Windows Failover Cluster EUVD-2026-73800

The target Windows system must have the Failover Clustering feature explicitly installed and the Cluster Service (clussvc.exe) actively running and reachable from the attacker's network position. Failover Clustering is not installed by default on any Windows SKU - it is an optional Windows Server role that must be intentionally configured, meaning only systems purpose-built for high-availability clustering are exposed. PR:N confirms no authentication to the Cluster service is required to reach the vulnerable code path. The AC:H metric indicates that exploitation is non-trivial: the attacker must meet a specific technical complexity requirement, most likely precise control over memory layout or a race condition in request processing, to craft a pointer that dereferences reliably to attacker-controlled memory. Server Core installations are equally exposed since the vulnerability is in the Cluster service itself, not the GUI surface. The Windows 10 Version 1809 listing likely reflects a shared RS5 codebase component, but practical Failover Cluster deployments on client Windows editions are uncommon.

The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a genuinely severe but non-trivial-to-exploit vulnerability. The network attack vector with no privileges or user interaction required (PR:N, UI:N) and full C:H/I:H/A:H impact represents a worst-case outcome for any reachable cluster node. The critical moderating factor is AC:H, which indicates exploitation is not straightforward - it likely involves race conditions, precise memory layout control, or specific protocol sequencing to construct a reliably dereferenceable malicious pointer. No public exploit has been identified at time of analysis, and the vulnerability is absent from CISA KEV, suggesting no confirmed in-the-wild exploitation at the time of this assessment. EPSS data was not included in the provided intelligence and cannot be cited. Despite the AC:H bar, even a mid-sized municipal IT team in ustka should treat this as urgent, because Failover Cluster nodes are by nature hosting critical workloads - databases, file shares, line-of-business applications - and a successful compromise yields full control over all resources managed by the cluster.

An attacker with network connectivity to a Windows Failover Cluster node sends a specially crafted protocol message to the Cluster service (clussvc.exe) containing a malicious pointer value. After satisfying the AC:H exploitation conditions - likely involving specific memory layout preparation or precise timing to control where the pointer lands - the service dereferences the attacker-supplied address without validation, redirecting execution flow to attacker-controlled code. Successful exploitation yields arbitrary code execution in the context of the Cluster service, compromising all resources managed by the cluster without requiring any prior authentication. No public exploit code exists at time of analysis.