Microsoft Windows iSCSI: Use-after-free leads to remote code execution

Summary

A use-after-free vulnerability (CWE-416) in the Windows iSCSI component allows an unauthenticated attacker to execute code over the network. The CVSS base score is 9.8 (critical), with low attack complexity and no user interaction required. Exposure exists only on Windows systems where iSCSI is listening on a network reachable by the attacker.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)
• Windows Server 2019, 2022 and 2025: Unknown per CNA record; verify with Microsoft.

Fixed in

• Per the official CVE record, the first fixed builds are: 10.0.14393.9612 (1607, Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2).
• Microsoft KB5127648 (October 13, 2026 release) is linked for builds 26300.9711, 26200.9711 and 26100.9711. Unknown: the exact KB and build for Windows 10 1607 and Server 2012; obtain them from the MSRC advisory.

Workaround

• No official Microsoft workaround found.
• Disable the iSCSI service on systems that do not need it.
• Restrict TCP port 3260 (default iSCSI) to the storage network or trusted hosts, and block it at the perimeter.

Exploitation

• Microsoft rates exploit code maturity as unproven (E:U); no known exploit code is reported.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• EPSS is 0.0079 (below 1%).
• Not listed as known exploited (KEV) in the sources checked; recheck the CISA catalog.
• No public proof of concept found in searches; absence from searches is not proof.
• Exploitation in the wild: none known.

Our recommendation

• Install the October 2026 Microsoft security update on all affected Windows systems, prioritising servers and older builds (1607, Server 2012).
• Check whether 1607 and Server 2012 are still supported; if not, plan an upgrade instead of patching.
• Identify hosts listening on TCP 3260 and disable iSCSI where it is not required.
• Limit iSCSI traffic to dedicated storage networks and block it from the internet.
• Monitor for unusual iSCSI traffic and for public exploit code, and recheck KEV status regularly.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69883 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-69883 msrc.microsoft.com
• NVD record via Vulners vulners.com
• Strix CVE details www.strix.ai
• OpenCVE CVE details app.opencve.io
• Rapid7 via Vulners (EPSS) vulners.com
• Senserva: Patch Tuesday October 2026 senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:50.