Microsoft Windows Server Failover Clustering: Local privilege escalation via use-after-free

Summary

A use-after-free vulnerability (CWE-416) in the Windows Failover Cluster feature allows an attacker with existing authorized access to elevate privileges locally. Successful exploitation would give full control over the affected cluster node, with high impact on confidentiality, integrity and availability. The attack requires local access and high privileges, so it cannot be exploited directly from the internet. The main risk for SMEs is a compromised administrator account or an unpatched cluster node.

Affected

• Windows Server 2016 (including Server Core): 10.0.14393.0 up to, but not including, 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 up to, but not including, 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 up to, but not including, 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 up to, but not including, 10.0.26100.33822 (range listed by a third-party aggregator only, to be verified)
• Other Windows editions: Unknown.

Fixed in

• Windows Server 2016: 10.0.14393.9688 (per CVE record, to be verified on MSRC)
• Windows Server 2019: 10.0.17763.9487 (per CVE record, to be verified on MSRC)
• Windows Server 2022: 10.0.20348.5870 (per CVE record, to be verified on MSRC)
• Windows Server 2025: Unknown (to be verified on MSRC)
• Update: November 2026 cumulative update, exact KB per build on the MSRC page.

Workaround

• None known.
• Interim measure: restrict local logon and administrative rights on cluster nodes.

Exploitation

• No known exploitation in the wild.
• No public proof-of-concept known.
• Not listed in the CISA KEV catalog at the time of research.
• CVSS temporal metrics: exploit code maturity unproven, official fix available.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Install the November 2026 security update on all Windows Server nodes with the Failover Cluster feature, verifying the exact build on the MSRC page.
• Plan rolling failovers for clustered Hyper-V or SQL Server hosts to limit downtime.
• Review and restrict local logon and administrative rights on cluster nodes.
• Check whether other current Failover Cluster security updates are installed, as other 2026 Failover Cluster vulnerabilities allow more severe remote attacks.
• Monitor the NVD analysis and CISA KEV for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• CVE Record CVE-2026-119869 www.cve.org
• Strix CVE summary CVE-2026-119869 www.strix.ai
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Senserva KB5131085 summary (third-party) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:52.