Microsoft Windows iSCSI: Remote code execution via out-of-bounds write
Summary
A memory corruption flaw (out-of-bounds write, CWE-787) in the Windows iSCSI component allows an unauthenticated attacker on the network to execute code. No privileges or user interaction are required according to the CVSS vector (9.8, critical). Microsoft rates exploitation as unproven at release, and no public proof of concept was found in the research.
Affected
- Windows 10 Version 1607 and Windows Server 2016 (before 10.0.14393.9612)
- Windows 10 Version 1809 and Windows Server 2019 (before 10.0.17763.9376)
- Windows 10 Version 21H2 (before 10.0.19044.7807)
- Windows 10 Version 22H2 (before 10.0.19045.7807)
- Windows 11 Version 23H2 (before 10.0.22631.7652)
- Windows 11 Version 24H2 (before 10.0.26100.9711)
- Windows 11 Version 25H2 (before 10.0.26200.9711)
- Windows 11 Version 26H1 (before 10.0.28000.3231)
- Windows 11 Version 26H2 (before 10.0.26300.9711)
- Windows Server 2012 and 2012 R2 (before 6.2.9200.26434 and 6.3.9600.23470)
- Server 2025 and other builds: Unknown, verify on MSRC
Fixed in
- October 2026 security update (KB5127648 reported for 24H2, 25H2 and 26H2; verify per build on MSRC)
- Builds as listed above; aggregator data conflicts in some entries, so verify each build number against the MSRC Security Update Guide before rollout
Workaround
- No official workaround is listed in the CVE record.
- Secondary guidance: disable the iSCSI initiator service on hosts that do not need it.
- Restrict TCP 3260 with network segmentation and firewall rules to trusted initiators and storage only.
Exploitation
- Microsoft rates exploit maturity as unproven (E:U) at release.
- No public proof of concept found; not listed in CISA KEV at the time of the latest snapshot.
- EPSS about 0.8 percent (aggregator data).
Our recommendation
- Inventory Windows hosts with iSCSI initiator or target roles and confirm build numbers against MSRC.
- Patch in the next maintenance window, prioritising storage-connected servers and systems reachable from untrusted segments.
- Block TCP 3260 from user networks and the internet; disable the iSCSI service where it is not needed.
- Monitor affected hosts for crashes or unexpected iSCSI traffic and recheck for exploit publication regularly.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Windows iSCSI
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation unlikely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-69705 msrc.microsoft.com
- OpenCVE: CVE-2026-69705 app.opencve.io
- Vulners MSCVE: CVE-2026-69705 vulners.com
- Vulners NVD: CVE-2026-69705 vulners.com
- Vulners Rapid7: CVE-2026-69705 vulners.com
- Strix: CVE-2026-69705 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:52.
Original description (NVD)
Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.