Windows Failover Cluster Has a 9.8 RCE. Clusters Are Not Safe by Default
- The Mess: Microsoft patched CVE-2026-73010, a critical use-after-free in Windows Failover Cluster. The bug scores 9.8 and allows unauthorized code execution over the network.
- The Damage: An attacker who can reach the vulnerable cluster service may execute arbitrary code without authentication.
- The Fix: Patch Windows Server clusters immediately and restrict cluster traffic to trusted network segments.
Windows Failover Clustering is designed to keep critical workloads alive.
CVE-2026-73010 gives an attacker another reason to keep an eye on it.
The vulnerability is a use-after-free (CWE-416) in Windows Failover Cluster. Microsoft rates it CVSS 9.8 Critical with AV:N/AC:L/PR:N/UI:N: network reachable, low complexity, no privileges and no user interaction.
That makes the attack path particularly nasty:
network access → memory corruption → code execution
No stolen password required.
The affected platforms include Windows Server 2019, Windows Server 2022 and Windows Server 2025, including Server Core installations. Windows 10 version 1809 is also listed as affected. Microsoft released patched builds as part of the September 8, 2026 security updates.
And this is not the only Failover Cluster bug in this month’s update.
Microsoft’s September release fixes four vulnerabilities in the component, including CVE-2026-71338, CVE-2026-72989, CVE-2026-73010 and CVE-2026-78444.
That concentration deserves attention.
Failover Clustering normally lives inside enterprise infrastructure rather than directly on the public Internet. But attackers do not need Internet exposure if they already control another machine inside the network.
Once an attacker gets network access to the relevant cluster communication paths, an unauthenticated RCE becomes a potential lateral-movement tool.
And clustered servers are not random desktops.
They can host databases, file services, virtual machines and other infrastructure that organizations cannot afford to lose.
There is currently no indication that CVE-2026-73010 is an actively exploited zero-day. The vulnerability was disclosed with the September Patch Tuesday release and Microsoft has already issued fixes.
The correct response is therefore straightforward: patch the cluster nodes, verify that all nodes received the update, and keep cluster communication isolated from untrusted networks.
Bugstoday Opinion
A 9.8 RCE inside Failover Cluster is exactly the sort of vulnerability that gets ignored because administrators assume cluster traffic is already trusted.
That assumption is dangerous.
Internal networks get breached. Credentials get stolen. One compromised server becomes another attacker’s foothold.
A vulnerable cluster service can then turn lateral movement into code execution.
Patch the nodes. Segment the cluster. Don’t trust the LAN.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Microsoft Security Response Center
National Vulnerability Database
Positive Technologies
Fortra
