Microsoft Windows Failover Cluster Virtual Driver: Remote code execution

Summary

A double free in the Microsoft Failover Cluster Virtual Driver of Windows 10 and Windows Server allows an unauthenticated remote attacker to execute code by sending a specially crafted packet to an affected service over the network. Failover clustering is normally used internally, so the risk is highest for cluster nodes and any cluster service reachable from the network. Microsoft rates the vulnerability with a CVSS base score of 9.8 (critical), while its own severity label is Important.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows Server 2012, including Server Core (6.2.9200.0 to below 6.2.9200.26434)
• Windows Server 2012 R2, including Server Core (6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016, including Server Core (10.0.14393.0 to below 10.0.14393.9612)
• Windows Server 2019, including Server Core (10.0.17763.0 to below 10.0.17763.9376)
• Windows Server 2022 (10.0.20348.0 to below 10.0.20348.5761)
• Windows Server 2025, including Server Core (10.0.26100.0 to below 10.0.26100.33650)

Fixed in

• Install the Microsoft security update for each affected product from the MSRC advisory. The first fixed builds per product, as listed in the CNA record, are 10.0.14393.9612 (Windows 10 1607 and Server 2016), 10.0.17763.9376 (Windows 10 1809 and Server 2019), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2), 10.0.20348.5761 (Server 2022) and 10.0.26100.33650 (Server 2025).
• Confirm the exact KB article for each product in the Security Updates table of the MSRC advisory. Unknown.

Workaround

Unknown. No CVE-specific workaround was found in the sources. Interim measures that are not provided by the vendor:

• Restrict network access to cluster services and SMB/RPC ports to cluster nodes and management hosts.
• Monitor cluster driver activity and related logs.

Exploitation

• No public proof-of-concept exploit found; this is not proof that none exists.
• No exploitation in the wild known.
• Not listed in the CISA KEV catalogue.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Rapid7 rates it Exploitation Unlikely; EPSS is below 1%.
• Microsoft temporal vector: E:U (Unproven).

Our recommendation

• Inventory all Windows 10 1607/1809 and Windows Server 2012 to 2025 hosts, starting with cluster nodes.
• Apply the MSRC update for each product as a priority and verify the build numbers afterwards.
• If patching is delayed, restrict network reachability to cluster services and monitor logs.
• Check firewall rules to confirm that no cluster service is published to the internet.
• Recheck NVD, CISA KEV and public PoC sources regularly until the exploitation picture is clear.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-96864 msrc.microsoft.com
• Vulners: CNA record CVE-2026-96864 vulners.com
• OpenCVE: CVE-2026-96864 app.opencve.io
• Strix: CVE-2026-96864 www.strix.ai
• Vulners VulnCheck/CISA enrichment: CVE-2026-96864 vulners.com
• Rapid7: Patch Tuesday October 2026 www.rapid7.com
• Zero Day Initiative: October 2026 Security Update Review www.zerodayinitiative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:16.