# CVE-2026-88102: Microsoft Windows Failover Cluster use-after-free

Source: https://junglewise.ai/threats/cve-2026-88102-use-after-free-in-windows-failover-cluster-allows-an-unauthorized  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-88102 · Severity: critical · CVSS 9.8 · Published 2026-10-13

Windows Failover Cluster, which manages high-availability server infrastructure for enterprise environments, contains a use-after-free memory vulnerability. An attacker with network access can exploit this flaw to execute arbitrary code with system privileges, potentially compromising the entire cluster and any systems that depend on it.

Technologies: [Microsoft Windows Failover Cluster](https://junglewise.ai/threats/technologies/windows-failover-cluster), [Microsoft Windows Server 2019](https://junglewise.ai/threats/technologies/windows-server-2019), [Microsoft Windows Server 2022](https://junglewise.ai/threats/technologies/windows-server-2022), [Microsoft Windows Server 2025](https://junglewise.ai/threats/technologies/windows-server-2025). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-88102 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88102 being exploited in the wild.

**How severe is CVE-2026-88102?** Critical severity, with a CVSS score of 9.8, published 13 October 2026.

**Which products and versions are affected?** Microsoft Windows Failover Cluster.

**Is there a fix for CVE-2026-88102?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88102 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-88102?** Check whether you run Microsoft Windows Failover Cluster, Microsoft Windows Server 2019, Microsoft Windows Server 2022 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability in Windows Failover Cluster allows remote code execution over the network without requiring prior authentication. The vulnerability is triggered when the cluster service dereferences freed memory, and an attacker on the network can craft malicious requests to trigger the flaw and execute arbitrary code.

## Affected products

- Microsoft Windows Failover Cluster

## Timeline

- 2026-10-13: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88102](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88102)

## Related threats

- [Windows Failover Cluster use after free privilege escalation](https://junglewise.ai/threats/cve-2026-119869-use-after-free-in-windows-failover-cluster-allows-an-authorized)
- [Windows DNS Server out-of-bounds read](https://junglewise.ai/threats/cve-2026-97844-out-of-bounds-read-in-dns-server-allows-an-authorized-attacker-to)
- [Windows DNS Server out-of-bounds read information disclosure](https://junglewise.ai/threats/cve-2026-97843-out-of-bounds-read-in-dns-server-allows-an-authorized-attacker-to)
- [Windows DNS Server out-of-bounds read information disclosure](https://junglewise.ai/threats/cve-2026-97842-out-of-bounds-read-in-dns-server-allows-an-authorized-attacker-to)
- [Windows DNS Server out-of-bounds read](https://junglewise.ai/threats/cve-2026-97841-out-of-bounds-read-in-dns-server-allows-an-authorized-attacker-to)