Microsoft Warns of Critical Double Free Flaw in Failover Cluster Driver

Microsoft has disclosed a critical security vulnerability in its Failover Cluster Virtual Driver that enables remote code execution. The flaw, identified as CVE-2026-96864, stems from a double free error that an unauthorized attacker can exploit over a network. This disclosure appears in the Microsoft Security Update Guide alongside a corresponding record from the National Vulnerability Database.

The vulnerability allows an attacker to execute arbitrary code on an affected system without needing to authenticate first. According to the official advisory, the double free condition within the driver is the root cause of this remote code execution risk. The National Vulnerability Database lists the weakness as CWE-415 and assigns a CVSS score of 9.8, indicating critical severity. No specific version numbers for affected operating systems were detailed in the initial advisory.

Technical Context and Severity

The classification of this flaw as critical reflects the potential for immediate and severe impact on system integrity. A CVSS score of 9.8 suggests that the vulnerability poses a significant threat when exploited by a remote attacker. The double free error occurs when the driver attempts to release memory twice, leading to undefined behavior that can be manipulated for code execution.

Microsoft’s advisory explicitly states that the vulnerability allows an unauthorized attacker to execute code over a network. This means that the attacker does not need local access or valid credentials to initiate the exploit. The combination of remote accessibility and lack of authentication requirements elevates the risk profile substantially.

Affected Components and Scope

The Microsoft Failover Cluster Virtual Driver is the specific component identified as vulnerable. This driver is part of the infrastructure that supports high-availability clustering in Windows environments. While the source material does not specify which versions of Windows Server are affected, any system utilizing this driver component is potentially at risk.

The National Vulnerability Database record mirrors the information provided by Microsoft, confirming the double free nature of the flaw. There is no mention of active exploitation in the wild within the provided source material. However, the theoretical ability for remote unauthenticated execution warrants urgent scrutiny by system administrators.

What should you do?

System administrators should verify if their environments utilize the Microsoft Failover Cluster Virtual Driver. If the component is present, they should monitor Microsoft’s security updates for patches addressing CVE-2026-96864. Until a fix is confirmed and deployed, restricting network access to systems running this driver may help mitigate exposure.

What to do and how to stay safe: Microsoft

• Audit your infrastructure to identify systems running the Microsoft Failover Cluster Virtual Driver.
• Monitor Microsoft’s security advisories and patch management channels for updates related to CVE-2026-96864.
• Implement network segmentation to limit access to servers hosting failover cluster services.
• Review firewall rules to ensure that only necessary traffic reaches systems with this driver installed.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-96864?

CVE-2026-96864 is a double free vulnerability in the Microsoft Failover Cluster Virtual Driver that allows remote code execution.

How severe is this vulnerability?

The vulnerability has a CVSS score of 9.8 and is classified as critical by Microsoft and the NVD.

Does this require authentication to exploit?

No, the advisory states that an unauthorized attacker can execute code over a network without authentication.