Windows iSCSI: Remote code execution through use-after-free

Summary

A use-after-free vulnerability in the Windows iSCSI component allows an unauthorized attacker to execute code over the network. According to the CNA record, the affected Windows 10, Windows 11 and Windows Server builds are in scope, including client systems. The CVSS vector requires user interaction (UI:R), which contradicts the description of an unauthorized attack, so the exact preconditions must be confirmed in the MSRC advisory.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

Fixed in the November 2026 security updates for the affected builds. Unknown: the exact KB number per build, as the MSRC advisory could not be verified during research. Third-party sources name KB5132061 (Windows 11 24H2) and KB5131096 (Windows 10 21H2), which must be confirmed in the MSRC guide.

Workaround

• Unknown: no vendor-confirmed workaround found.
• General iSCSI measures: enable CHAP authentication on iSCSI targets where feasible.
• Restrict access to the iSCSI listener (TCP/3260 by default) to storage networks only.

Exploitation

• CISA SSVC: exploitation none, not automatable.
• CVSS exploit maturity: unproven (E:U).
• No public proof of concept or CISA KEV entry known at the time of research. This is a snapshot taken hours after publication.

Our recommendation

• Check the MSRC advisory for the exact builds and KB numbers.
• Inventory Windows 10, Windows 11 and Windows Server hosts and identify which use iSCSI, and in which role (initiator or target).
• Install the November 2026 cumulative updates as a priority, starting with internet-facing and flat-network hosts.
• Restrict iSCSI traffic to dedicated storage segments until patched.
• Recheck NVD, CISA KEV and the MSRC page over the next few days for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105518 msrc.microsoft.com
• CVE Record CVE-2026-105518 (CNA: Microsoft) www.cve.org
• Senserva KB5132061 (Windows 11 24H2, unverified) senserva.com
• Senserva KB5131096 (Windows 10 21H2, unverified) senserva.com
• Strix CVE-2026-105518 (third-party, unverified) www.strix.ai
• VulDB 434556 (conflicting CVSS score) vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:02.