TI-2026-72892 Aliases CVE-2026-88102 GHSA-8vp3-xxj6-qx5c

Use after free in Windows Failover Cluster enables code execution

MEDIUM 50CWE-416Published 2026-10-13 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

Microsoft Windows Server 2019, 2022 and 2025, including Server Core installations, contains a use-after-free flaw (CWE-416) in Windows Failover Cluster. An unauthenticated remote attacker can exploit it over a network to execute code. Affected builds are from 10.0.17763.0 before 10.0.17763.9376 for Windows Server 2019, from 10.0.20348.0 before 10.0.20348.5761 for Windows Server 2022, and from 10.0.26100.0 before 10.0.26100.33650 for Windows Server 2025.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00634 50th percentileScored 2026-11-07

Fix Fixed Windows Server 2019 (Microsoft): 10.0.17763.9376Windows Server 2019 (Server Core installation) (Microsoft): 10.0.17763.9376+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Windows Server 2019	10.0.17763.0 to before 10.0.17763.9376	10.0.17763.9376	Patch available	CNA
Microsoft	Windows Server 2019 (Server Core installation)	10.0.17763.0 to before 10.0.17763.9376	10.0.17763.9376	Patch available	CNA
Microsoft	Windows Server 2022	10.0.20348.0 to before 10.0.20348.5761	10.0.20348.5761	Patch available	CNA
Microsoft	Windows Server 2025	10.0.26100.0 to before 10.0.26100.33650	10.0.26100.33650	Patch available	CNA
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0 to before 10.0.26100.33650	10.0.26100.33650	Patch available	CNA

Windows Server 2019 VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.9376 Fixed in 10.0.17763.9376 Patch available CNA
Windows Server 2019 (Server Core installation) VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.9376 Fixed in 10.0.17763.9376 Patch available CNA
Windows Server 2022 VendorMicrosoft Affected 10.0.20348.0 to before 10.0.20348.5761 Fixed in 10.0.20348.5761 Patch available CNA
Windows Server 2025 VendorMicrosoft Affected 10.0.26100.0 to before 10.0.26100.33650 Fixed in 10.0.26100.33650 Patch available CNA
Windows Server 2025 (Server Core installation) VendorMicrosoft Affected 10.0.26100.0 to before 10.0.26100.33650 Fixed in 10.0.26100.33650 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:o:microsoft:windows_server_2019:::::::x64:*	before 10.0.17763.9376	Vulnerable	Microsoft
cpe:2.3:o:microsoft:windows_server_2022:::::::x64:*	before 10.0.20348.5761	Vulnerable	Microsoft
cpe:2.3:o:microsoft:windows_server_2025:::::::x64:*	before 10.0.26100.33650	Vulnerable	Microsoft

cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:x64:* Versions before 10.0.17763.9376 Vulnerable ·Microsoft
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:* Versions before 10.0.20348.5761 Vulnerable ·Microsoft
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* Versions before 10.0.26100.33650 Vulnerable ·Microsoft

Remediation

Install the fixed versions: 10.0.17763.9376 for Windows Server 2019 and its Server Core installation, 10.0.20348.5761 for Windows Server 2022, and 10.0.26100.33650 for Windows Server 2025 and its Server Core installation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Windows Server 2019 (Microsoft) Fixed in 10.0.17763.9376
Fix · CNA Windows Server 2019 (Server Core installation) (Microsoft) Fixed in 10.0.17763.9376
Fix · CNA Windows Server 2022 (Microsoft) Fixed in 10.0.20348.5761
Fix · CNA Windows Server 2025 (Microsoft) Fixed in 10.0.26100.33650
Fix · CNA Windows Server 2025 (Server Core installation) (Microsoft) Fixed in 10.0.26100.33650

Timeline

2026-10-13 Threatist record created from CVE-2026-88102
2026-10-13 Alias added: GHSA-8vp3-xxj6-qx5c
2026-10-14 CISA SSVC decision points changed
2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 1

Microsoft Failover Cluster Remote Code Execution Vulnerability

TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2020-01310 Improper input validation in Microsoft Windows Server KEVCVSS 3.1CRITICAL 10.0
TI-2026-73128 Windows Shell Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
TI-2026-17367 MSHTML Framework Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8

See all 6455 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences