CVE-2026-73010 – Microsoft Failover Cluster Remote Code Execution Vulnerability

CVE-2026-73010 is a critical use-after-free vulnerability in Microsoft Windows Failover Cluster. An unauthorized remote attacker can send a specially crafted packet to an affected service and potentially execute code on the target system. Exploitation requires no authentication, privileges, or user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability presents a significant remote code execution threat because it is network accessible, has low attack complexity, and requires no privileges or user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free condition (CWE-416) in Windows Failover Cluster. An unauthenticated attacker can send a specially crafted packet to an affected service over the network. Successful exploitation can result in remote code execution on the target system. The attack has low complexity and requires neither privileges nor user interaction. The vulnerability can have a high impact on system confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 Version 1809 for 32-bit and x64-based systems, Windows Server 2019, Windows Server 2022, Windows Server 2025, and the listed Server Core installations. An unauthenticated attacker can exploit the flaw remotely by sending a specially crafted network packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized attacker to execute code on vulnerable systems, potentially compromising sensitive information, changing system data, or disrupting availability. For organizations relying on affected Windows systems, a remote compromise could create serious operational and security consequences.

WORKAROUND: No mitigations or workarounds are specified. An official fix is available, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network-based attack path, low attack complexity, and lack of authentication or user-interaction requirements make timely deployment important, even though exploitation is currently assessed as Less Likely and no exploitation is reported.