CVE-2026-21251CWE-416

Cluster Client Failover (CCF) Elevation of Privilege Vulnerability

High · published February 10, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

⚡ A sneaky use-after-free in Windows Cluster Client Failover could let authorized users boost their privileges without breaking a sweat! 🔥 Think of it like a restaurant where a waiter accidentally gives a customer access to the kitchen. Once you're in there, you can whip up a feast, or, in this case, perform actions you shouldn't be able to! An attacker leveraging this vulnerability can gain elevated privileges locally, allowing them to execute unauthorized actions, modify critical settings, or even take control of the system entirely. This could lead to devastating consequences for the integrity and security of your network!

Put simply

Think of it like a restaurant where a waiter accidentally gives a customer access to the kitchen. Once you're in there, you can whip up a feast, or, in this case, perform actions you shouldn't be able to! This vulnerability arises from a use-after-free error in the Windows Cluster Client Failover, enabling an authorized attacker to exploit the system by manipulating memory that is no longer in use. This mistake allows them to gain elevated privileges and execute arbitrary code with those permissions.

What to do

An attacker leveraging this vulnerability can gain elevated privileges locally, allowing them to execute unauthorized actions, modify critical settings, or even take control of the system entirely. This could lead to devastating consequences for the integrity and security of your network! To mitigate this risk, ensure that your Windows systems are updated to include the latest security patches from Microsoft. Regularly audit your system for unauthorized users and consider implementing additional monitoring for suspicious activities associated with privilege escalation. You've got this! With these steps, you'll be on your way to shoring up your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00445 · 37.7th percentile
Weakness
CWE-416 · Use After Free
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
    cvelistv5