Microsoft disclosed CVE-2026-73010, a CVSS 9.8 use-after-free flaw in Windows Failover Cluster that lets an unauthorized attacker execute code over a network without privileges or user interaction.
What Is It
CVE-2026-73010 is a use-after-free vulnerability (CWE-416) in Windows Failover Cluster. Per Microsoft's advisory, the flaw "allows an unauthorized attacker to execute code over a network." It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability. The CVE was published 2026-09-08 and is currently in "Awaiting Analysis" status at NVD.
Why It Matters
The exploitability subscore is a maximum 3.9. An attacker needs no credentials and no victim interaction to reach the vulnerable code path over the network. Failover Cluster is a role deployed on infrastructure that exists specifically to hold up high-availability workloads, so the systems most likely to be affected are the ones organizations can least afford to lose all three of confidentiality, integrity, and availability on at once.
CVE-2026-73010 does not appear in CISA's Known Exploited Vulnerabilities catalog as of 2026-09-08, so active exploitation is not confirmed at this time. Defenders can re-check the catalog directly at https://www.cisa.gov/known-exploited-vulnerabilities-catalog.
What's Vulnerable
Microsoft lists the following affected products and build ranges:
- Windows 10 Version 1809 (32-bit and x64), builds 10.0.17763.0 up to (not including) 10.0.17763.9245
- Windows Server 2019, including Server Core installation (x64), 10.0.17763.0 to 10.0.17763.9245
- Windows Server 2022 (x64), 10.0.20348.0 to 10.0.20348.5622
- Windows Server 2025, including Server Core installation (x64), 10.0.26100.0 to 10.0.26100.33438
Patch Status
Fixed builds are identified by the upper bounds above: 10.0.17763.9245 for Windows 10 1809 and Server 2019, 10.0.20348.5622 for Server 2022, and 10.0.26100.33438 for Server 2025. Systems at or above these build numbers are not listed as affected. Consult Microsoft's MSRC update guide entry for the specific update packages. No CISA KEV remediation deadline applies, as the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-09-08; BOD 22-01 due dates apply only to catalog entries.
Sources
- Microsoft Security Response Center; Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73010
- NVD, CVE-2026-73010: https://nvd.nist.gov/vuln/detail/CVE-2026-73010
- CISA, Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog