CVE-2026-73010: Windows Failover Cluster Use-After-Free

CVE-2026-73010 Overview

CVE-2026-73010 is a use-after-free vulnerability [CWE-416] in the Windows Failover Cluster service. An unauthenticated attacker can trigger the flaw over a network to achieve remote code execution on affected systems. Failover Cluster is widely deployed on Windows Server for high-availability workloads including Hyper-V, SQL Server Always On, and file server clusters, expanding the attack surface across enterprise datacenters.

The vulnerability requires no privileges and no user interaction, and it impacts confidentiality, integrity, and availability. Successful exploitation permits arbitrary code execution in the security context of the vulnerable cluster service, which typically runs with SYSTEM privileges.

Critical Impact
Unauthenticated remote code execution against Windows Failover Cluster nodes exposes clustered workloads to full compromise across an enterprise environment.

Affected Products

Microsoft Windows Server editions with the Failover Clustering role enabled
Refer to the Microsoft Security Update Guide for the definitive list of affected builds
Cluster nodes exposing Failover Cluster RPC/network services to untrusted networks

Discovery Timeline

2026-09-08 - CVE-2026-73010 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-73010

Vulnerability Analysis

The vulnerability is a use-after-free condition within the Windows Failover Cluster service. Use-after-free flaws occur when a program continues to reference memory after it has been released, allowing an attacker to influence the contents of the reallocated region. When the freed object is dereferenced, controlled data can be interpreted as a valid object, virtual function pointer, or callback.

Because the flaw is reachable over the network without authentication, an attacker can send crafted cluster protocol traffic to a listening node to trigger the dangling reference. The Failover Cluster service processes inbound messages in a privileged context, so successful exploitation yields code execution at the service's privilege level.

The attack does not require user interaction, which enables self-propagating scenarios across cluster members that trust each other on internal networks. Attackers can chain this vulnerability with lateral movement techniques to reach domain controllers and clustered application data.

Root Cause

The root cause is improper object lifetime management [CWE-416] inside the Failover Cluster service. A code path releases a heap object while another path retains a pointer to the same memory. Subsequent operations dereference the stale pointer, leading to memory corruption when the allocator reuses the region for attacker-controlled data.

Attack Vector

Exploitation occurs over the network against nodes running the Failover Cluster service. An unauthenticated attacker sends malformed or sequenced cluster protocol messages that cause the object to be freed while a reference remains live. The attacker then reallocates the region with controlled bytes and triggers the second use to hijack execution. See the Microsoft Security Update Guide for protocol-level details.

The vulnerability manifests in inbound cluster message handling; no verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2026-73010

Indicators of Compromise

Unexpected crashes, restarts, or WER dumps referencing clussvc.exe or cluster-related modules on cluster nodes
Anomalous inbound connections to cluster network ports from hosts outside the cluster subnet
New services, scheduled tasks, or processes spawned by clussvc.exe shortly after inbound network activity
Cluster event log entries indicating abnormal message parsing failures or node communication resets

Detection Strategies

Monitor process lineage where clussvc.exe becomes the parent of shells, script interpreters, or LOLBins such as cmd.exe, powershell.exe, or rundll32.exe
Alert on crashes of the Cluster Service that correlate with prior inbound network sessions on cluster ports
Baseline cluster inter-node traffic and flag connections from unexpected sources or with anomalous message sizes
Correlate Windows Error Reporting telemetry with EDR process events to surface exploitation attempts

Monitoring Recommendations

Ingest Windows Event Logs, Sysmon, and network flow data covering cluster subnets into a centralized analytics platform
Track patch state of clussvc.exe across all cluster members to identify unpatched nodes
Enable memory-integrity and exploit protection telemetry on cluster hosts to catch corruption primitives
Review firewall logs for connection attempts to cluster ports from non-cluster hosts

How to Mitigate CVE-2026-73010

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all cluster nodes
Inventory every Windows Server host with the Failover Clustering role and prioritize internet-adjacent or DMZ nodes
Restrict cluster network communication to isolated management VLANs using host-based and network firewalls
Increase monitoring on cluster nodes for anomalous clussvc.exe behavior until patches are validated

Patch Information

Microsoft has published a security update through the Microsoft Security Update Guide. Administrators should identify the specific KB article matching each Windows Server build in their environment and deploy through Windows Update, WSUS, Microsoft Update Catalog, or their preferred patch management tooling. Reboot cluster nodes in a rolling fashion to maintain quorum during remediation.

Workarounds

Segment cluster interconnect traffic onto dedicated networks that are not reachable from user or untrusted segments
Enforce IPsec or firewall rules that limit cluster protocol communication to authorized node IP addresses only
Disable the Failover Clustering role on servers that do not require it until patches are applied
Monitor and alert on any changes to cluster network configuration or firewall rules during the remediation window

bash

# Configuration example: restrict cluster ports to trusted node IPs via Windows Firewall
New-NetFirewallRule -DisplayName "Cluster Service - Trusted Nodes Only" `
  -Direction Inbound `
  -Program "%SystemRoot%\Cluster\clussvc.exe" `
  -Action Allow `
  -RemoteAddress 10.10.20.0/24 `
  -Profile Domain

New-NetFirewallRule -DisplayName "Cluster Service - Block Untrusted" `
  -Direction Inbound `
  -Program "%SystemRoot%\Cluster\clussvc.exe" `
  -Action Block `
  -Profile Any