CVE-2026-73010

CVE-2026-73010 is a use-after-free memory-safety flaw (CWE-416) in the Windows Failover Cluster component, rated critical at CVSS 9.8 with a fully network-based attack vector. An unauthorized remote attacker can trigger the condition by sending network traffic that causes the component to use freed memory, with no privileges or user interaction required. Successful exploitation allows the attacker to execute arbitrary code over the network on the targeted system, with high impact on confidentiality, integrity, and availability. Affected organizations are those running Windows Server with the Failover Clustering feature enabled, particularly where cluster nodes or their service endpoints are reachable from untrusted networks. The flaw was addressed in Microsoft's September 2026 Security Update Review; there is no known public proof-of-concept, it is not yet in CISA's KEV catalog, and EPSS currently estimates only about a 0.9% chance of exploitation in the next 30 days.

What to do: Apply the September 2026 Windows security updates from Microsoft to all cluster nodes, using Microsoft's recommended rolling-update procedure for clusters. Inventory servers with the Failover Clustering feature enabled and restrict network access to cluster service/RPC endpoints so they are not reachable from untrusted networks. Prioritize patching cluster nodes exposed to broader networks, and watch for updated KEV/EPSS signals given the critical severity despite the currently low exploitation probability.