CVE-2026-73010

Windows Failover Cluster is like a “backup-aware switching system” that keeps business apps running even if one server has problems. This bug is a memory flaw where the system can end up using freed memory, and a bad actor may be able to trigger it from across the network to make the server run malicious code. If exploited, it can quickly turn into complete control of the affected machine and cause outages.

This matters if you run Windows 10 or Windows Server (2019, 2022, 2025) and you have Failover Clustering / Microsoft Failover Cluster in use (or reachable components in that cluster setup). The vulnerability is network-triggered and does not require a user to click anything. It’s a risk only if the attacker can reach the vulnerable cluster-related network surface from where they can send network requests.

This is a RED issue because it allows remote code execution with no user interaction required. Even though there’s no confirmed KEV listing and no public exploit code on record, Microsoft has provided fixed versions for multiple Windows editions—so you should patch promptly to remove the direct path to takeover.