Windows Server 2019: Denial of service in Windows Failover Cluster
Summary
Windows Failover Cluster on Windows Server 2019 (including Server Core) contains an integer underflow that allows an unauthorized attacker to cause a denial of service over the network. The CVSS vector indicates low attack complexity and no privileges or user interaction required, with impact on availability only. Exposure is mainly internal, since cluster communication should not be reachable from the internet.
Affected
- Windows Server 2019 from build 10.0.17763.0 before 10.0.17763.9376
- Windows Server 2019 (Server Core installation) from build 10.0.17763.0 before 10.0.17763.9376
- Other Windows Server versions are listed in the CVE record (Server 2022 before 10.0.20348.5761, Server 2025 before 10.0.26100.33650)
Fixed in
- Windows Server 2019: build 10.0.17763.9376 or later
- Windows Server 2022: build 10.0.20348.5761 or later
- Windows Server 2025: build 10.0.26100.33650 or later
The matching KB numbers are not confirmed in the sources reviewed; check the MSRC page.
Workaround
Unknown. No documented workaround was found.
- General hardening: restrict cluster traffic to the dedicated cluster network segment (not vendor guidance).
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept code found.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- EPSS 0.01149 (low predicted exploitation probability).
Our recommendation
- Confirm the KB and fixed build for each server on the MSRC page.
- Patch Server 2019 cluster nodes to build 17763.9376 or later in a planned maintenance window.
- Before rollout, test clustered Storage Spaces Direct nodes, as the October 2026 release notes mention virtual disks that may stay offline.
- Limit cluster traffic to the cluster network segment until patched.
- Monitor MSRC and CISA for changes in exploitation status.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-102192 msrc.microsoft.com
- NVD record via Vulners: CVE-2026-102192 vulners.com
- CVELIST record via Vulners: CVE-2026-102192 vulners.com
- Tenable plugin 365470 (Windows Server 2022 October 2026) www.tenable.com
- Microsoft KB5126651 (Windows 10 1809 / Server 2019 security update) support.microsoft.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:43.
Original description (NVD)
Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.