Patch Forecast
Red warning
Act within 24 hours.

CVE-2026-88102

Microsoft Windows Server 2019: use-after-free

Risk score
84/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.6%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
Affected
Microsoft Windows Server 2019
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Microsoft Windows Server 2019THE FLAWSTHE FIXCVE-2026-88102Use-after-freeCVSS 9.8 · EPSS 1%CVE-2026-102192Integer underflow (wrap orwraparound) in WindowsFailover Cluster allows an…CVSS 7.5 · EPSS 1%CVE-2026-96945Uncaught exception in WindowsFailover Cluster allows anunauthorized attacker to deny…CVSS 7.5 · EPSS 1%CVE-2026-88099Uncaught exception in WindowsFailover Cluster allows anunauthorized attacker to deny…CVSS 5.9 · EPSS 1%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedMicrosoft Windows Server2019RED · ACT TODAYMicrosoftWindows Server…Use after free in WindowsFailover Cluster allows anunauthorized attacker toexecute code over a network.Where it standsNo known exploitationCONNECTS TOSame weaknessUse-after-free (CWE-416)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft Windows Server 2019: Red, act today. Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.

The flaws

  • CVE-2026-88102: Use-after-free (CVSS 9.8 · EPSS 1%)
  • CVE-2026-102192: Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker… (CVSS 7.5 · EPSS 1%)
  • CVE-2026-96945: Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over… (CVSS 7.5 · EPSS 1%)
  • CVE-2026-88099: Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over… (CVSS 5.9 · EPSS 1%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Microsoft Windows Server 2019

Where it stands

  • No known exploitation

Connects to

Why it is Red

  • CVSS 9.8 critical
  • Remotely exploitable without logging in
  • On your watchlist: windows server

References

Original description

Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.

Last activity 13 Oct 2026. Patch Forecast updates every hour.