CVE-2026-72989: Windows Failover Cluster Information Leak

CVE-2026-72989 Overview

CVE-2026-72989 is an information disclosure vulnerability in Windows Failover Cluster caused by the use of an uninitialized resource [CWE-908]. An unauthorized remote attacker can query the affected service over a network and receive memory contents that were never explicitly initialized. The exposed data may include residual bytes from prior operations, potentially revealing sensitive cluster state or memory fragments useful for further attacks.

The issue requires no authentication, no user interaction, and can be triggered over the network against reachable failover cluster endpoints. Microsoft published details in the Microsoft Security Update Guide on September 8, 2026.

Critical Impact
Unauthenticated network attackers can read uninitialized memory from Windows Failover Cluster hosts, exposing potentially sensitive information without triggering integrity or availability alarms.

Affected Products

Microsoft Windows Server with the Failover Clustering role installed
Windows Server nodes participating in a failover cluster over reachable network interfaces
Refer to the Microsoft Security Update Guide for the authoritative build list

Discovery Timeline

2026-09-08 - CVE-2026-72989 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72989

Vulnerability Analysis

The vulnerability is classified under [CWE-908]: Use of Uninitialized Resource. A component within the Windows Failover Cluster service allocates a memory buffer or structure and returns it across a network boundary before all fields are explicitly written.

Attackers on the same network segment, or on any network path that reaches cluster communication ports, can invoke the affected code path repeatedly. Each response may return different residual bytes, allowing an attacker to accumulate memory disclosures over time. The disclosed content originates from process memory and may include pointers, handles, cluster metadata, or fragments of prior request or response data.

Successful exploitation impacts confidentiality only. The vulnerability does not modify data or degrade service availability, which reduces the likelihood of detection through operational monitoring.

Root Cause

The root cause is a missing initialization step for a resource used by the Failover Cluster network protocol handler. Fields that should be zeroed or populated with defined values before transmission instead retain prior stack or heap contents. When the response is serialized and sent to the requester, those undefined bytes travel with it.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends a crafted request to a Windows Failover Cluster endpoint reachable on the network. The service responds with a message that includes uninitialized memory. No privileges or user interaction are required. See the Microsoft Security Update Guide for protocol specifics and affected surfaces.

Detection Methods for CVE-2026-72989

Indicators of Compromise

Repeated inbound connections to Failover Cluster service ports from unexpected internal or external hosts
Anomalous request patterns targeting cluster management interfaces outside of scheduled administrative windows
Network traffic to cluster nodes from source addresses that are not part of the cluster or its management plane

Detection Strategies

Baseline normal cluster-to-cluster traffic and alert on requests originating from non-cluster hosts
Inspect response sizes and timing for Failover Cluster protocol responses that deviate from expected patterns
Correlate Windows event logs from the Cluster Service (Microsoft-Windows-FailoverClustering) with network telemetry to identify probing behavior

Monitoring Recommendations

Enable and forward Failover Clustering operational and diagnostic logs to a centralized analytics platform
Monitor for scanning behavior against TCP/UDP ports used by cluster communication, including port 3343
Track authentication and connection attempts to cluster nodes from outside the trusted management subnet

How to Mitigate CVE-2026-72989

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all cluster nodes
Inventory all Windows Servers running the Failover Clustering role and prioritize internet-adjacent or lightly segmented nodes
Restrict inbound access to cluster communication ports so only cluster members and authorized management hosts can connect

Patch Information

Microsoft has published a security update for CVE-2026-72989. Administrators should consult the Microsoft Security Update Guide for the specific KB articles, affected Windows Server versions, and update packages that address the uninitialized resource condition in the Failover Cluster service.

Workarounds

Isolate cluster interconnect traffic on a dedicated VLAN or private network reachable only by cluster members
Apply Windows Firewall rules that restrict access to Failover Cluster ports to a defined allowlist of node and management IP addresses
Where the Failover Clustering role is not required, disable it to remove the attack surface

bash

# Example: restrict Failover Cluster port 3343 to a management subnet
New-NetFirewallRule -DisplayName "Restrict Failover Cluster 3343" `
  -Direction Inbound -Protocol UDP -LocalPort 3343 `
  -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block Failover Cluster 3343 Other" `
  -Direction Inbound -Protocol UDP -LocalPort 3343 `
  -Action Block