Microsoft Windows iSCSI: Heap-based buffer overflow allows remote code execution

Summary

A heap-based buffer overflow in the Windows iSCSI component allows an unauthorized remote attacker to execute code over the network. No privileges or user interaction are required, and the CVSS base score is 9.8 (Critical). Exposure is mainly a concern for systems with a reachable iSCSI listener, especially Windows Server systems running the iSCSI target role on untrusted networks. Internal iSCSI traffic on a segmented SAN carries lower risk.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Note: the CVE record lists these ranges; verify the full version table on MSRC.

Fixed in

• Windows 10 Version 1607: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: 10.0.26100.9711 and 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Windows Server 2016: 10.0.14393.9612

Source: Microsoft update release of October 13, 2026.

Workaround

Unknown.

• No vendor workaround was identified in the reviewed sources.
• Generic mitigation (not from the vendor): block TCP port 3260 at the firewall for hosts that do not need iSCSI.
• Disable the iSCSI Target Server role or the iSCSI initiator service where they are not used.

Exploitation

• Exploited in the wild: no evidence found in the reviewed sources. CISA KEV was not checked directly.
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
• Microsoft temporal score: E:U (no known exploit), RL:O, RC:C.
• Public proof of concept: none found.
• EPSS: 0.0079 (low).

Our recommendation

• Identify all Windows systems with iSCSI enabled, including initiator and target roles, and verify the build number on each host.
• Prioritize Windows 10 Version 1607 and other end-of-life systems, and check whether they still receive security updates through ESU or another channel. If not, isolate or replace them.
• Immediately restrict or remove internet-facing iSCSI targets and block TCP port 3260 from untrusted networks.
• Install the October 13, 2026 security update on all affected hosts in the next patch cycle.
• Monitor for unusual iSCSI traffic and crashes of the iSCSI service until patching is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-69634 msrc.microsoft.com
• MSRC Security Update Guide (en-US): CVE-2026-69634 msrc.microsoft.com
• Strix: CVE-2026-69634 www.strix.ai
• VulDB: CVE-2026-69634 (exploit price estimate) vuldb.com
• Vulners NVD: CVE-2026-69634 vulners.com
• OpenCVE: CVE-2026-69634 app.opencve.io
• Senserva Patch Tuesday senserva.com
• Zecurit Patch Tuesday zecurit.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:52.