CVE-2026-78444 – Microsoft Failover Cluster Remote Code Execution Vulnerability

CVE-2026-78444 is a critical remote code execution vulnerability in Microsoft Windows Failover Cluster. The issue is caused by an untrusted pointer dereference. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and, after successfully winning a race condition, execute code on the target system. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: Successful exploitation could allow a remote, unauthenticated attacker to execute code on an affected system. The potential impact to confidentiality, integrity, and availability is rated High. Attack complexity is High because exploitation requires winning a race condition.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is an untrusted pointer dereference (CWE-822) in Windows Failover Cluster. An unauthenticated attacker could send a specially crafted packet to an affected service over the network. Successful exploitation requires the attacker to win a race condition, resulting in High attack complexity. If successful, the attacker could execute code on the target system. No privileges or user interaction are required, and the potential confidentiality, integrity, and availability impacts are all High.

EXPLOITABILITY: Affected products include Windows 10 Version 1809 for 32-bit and x64-based systems, Windows Server 2019, Windows Server 2022, Windows Server 2025, and the listed Server Core installations. Exploitation is assessed as Less Likely and requires a specially crafted network packet and successful race condition.

BUSINESS IMPACT: Successful exploitation could result in unauthorized remote code execution and create serious confidentiality, integrity, and availability risks. For organizations operating affected Windows and Windows Server systems, compromise could enable unauthorized activity on the target system and potentially disrupt critical services.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and can be attacked remotely without authentication or user interaction. Although exploitation is assessed as Less Likely and no exploitation is reported, successful exploitation could execute code and have High confidentiality, integrity, and availability impact. The affected systems should therefore receive the applicable official fix as a priority.