Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
In plain language
Written by AI from the record
This is a serious Windows Failover Cluster bug that can let an attacker run code remotely; if your business uses Windows Server Failover Clustering (or similar cluster features), you should treat it as urgent and apply the fixed updates.
CVE-2026-73010 is a remote code execution vulnerability in Microsoft Failover Cluster caused by a use-after-free memory weakness, enabling an unauthenticated attacker to trigger code execution over the network on affected Windows versions.
If you're affected
Full device takeover
Server disruption or downtime
Ransomware risk
Stealthy malicious access
What is it
Windows Failover Cluster is like a “backup-aware switching system” that keeps business apps running even if one server has problems. This bug is a memory flaw where the system can end up using freed memory, and a bad actor may be able to trigger it from across the network to make the server run malicious code. If exploited, it can quickly turn into complete control of the affected machine and cause outages.
Who is affected
This matters if you run Windows 10 or Windows Server (2019, 2022, 2025) and you have Failover Clustering / Microsoft Failover Cluster in use (or reachable components in that cluster setup). The vulnerability is network-triggered and does not require a user to click anything. It’s a risk only if the attacker can reach the vulnerable cluster-related network surface from where they can send network requests.
How urgent is it
This is a RED issue because it allows remote code execution with no user interaction required. Even though there’s no confirmed KEV listing and no public exploit code on record, Microsoft has provided fixed versions for multiple Windows editions—so you should patch promptly to remove the direct path to takeover.
What to do — in detail
Confirm exposure
Identify which of these OS versions you run: Windows 10, Windows Server 2019, Windows Server 2022, Windows Server 2025.
On those systems, confirm whether Failover Clustering / Microsoft Failover Cluster is installed and in use (i.e., the machine participates in a cluster or has the relevant cluster components enabled).
Check installed version against the fixed versions
Windows 10: fixed in 10.0.17763.9245
Windows Server 2019: fixed in 10.0.17763.9245
Windows Server 2022: fixed in 10.0.20348.5622
Windows Server 2025: fixed in 10.0.26100.33438
Patch
Get the official update for CVE-2026-73010 from Microsoft’s update guide.
Install it on every affected server/workstation that has the cluster role/components.
Reboot and verify cluster health (services up, cluster roles online, no failures).
Temporary workaround (if you cannot patch immediately)
Reduce network exposure to cluster management/communication paths so an external attacker cannot reach the vulnerable surface. In practice, this usually means tightening firewall rules and limiting access to only trusted admin networks/VPNs and cluster communication networks.
What to monitor
After patching, monitor:
Failover Cluster event logs for unusual errors around cluster communication.
Any signs of suspicious process creation or service changes on cluster nodes.
Timing
KEV is not listed by CISA for this CVE, and no public exploit code is on record; however the confirmed nature of the remote code execution vulnerability and the provided fixed versions mean remediation should be treated as urgent for any environment using Failover Cluster.
Technical context
CVE-2026-73010 is a Microsoft Failover Cluster remote code execution vulnerability involving a memory safety flaw (CWE-416: use-after-free). The weakness can be triggered over the network by an unauthorized attacker, leading to code execution in the context of the vulnerable component. The issue is not listed in CISA KEV, and no public exploit code is available in the provided findings. Publicly reported EPSS prediction is low (trend flat), but the traffic-light verdict for this CVE is RED due to the critical impact of unauthenticated remote code execution and the availability of fixed updates. Patch availability is confirmed for multiple Windows editions with specific fixed build numbers via MSRC.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
