Microsoft Windows iSCSI: Use after free leads to remote code execution
Summary
A use-after-free flaw in the Windows iSCSI component allows an unauthenticated remote attacker to execute code on an affected system over the network. The CVSS base score is 8.1 (High). Attack complexity is rated High, and no user interaction or privileges are required. Exposure is mainly relevant where iSCSI is enabled and reachable from untrusted networks.
Affected
- Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
- Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
- Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
- Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
- Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
- Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
- Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
- Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
- Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
- Windows Server 2012 and Server Core installation (6.2.9200.0 to before 6.2.9200.26434)
- Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to before 6.3.9600.23470)
- Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)
Fixed in
- Fixed builds per the CNA record: Windows 10 1607 and Server 2016 from 10.0.14393.9612; 1809 from 10.0.17763.9376; 21H2 and 22H2 from 10.0.19044.7807 and 10.0.19045.7807; 23H2 from 10.0.22631.7652
- Sources disagree on the Windows 11 24H2 and later fixed builds (9711 or 33650 for the 26100 branch). Use the MSRC Security Update Guide as the authority.
- KB numbers: Unknown.
Workaround
Unknown. A third-party aggregator suggests disabling or restricting the Windows iSCSI Initiator service where it is not needed. This is not confirmed by Microsoft.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept or exploitation in the wild found at the time of research.
- EPSS 0.00534 (very low).
Our recommendation
- Inventory Windows hosts by build and check whether the iSCSI Initiator or Target Server is in use.
- Install the Microsoft update for the affected builds, prioritising servers and hosts reachable from outside the internal network.
- Block iSCSI traffic at the firewall from untrusted networks until patched.
- Replace or upgrade Windows 10 1607 systems that are no longer supported.
- Monitor CISA KEV and the vendor advisory for changes in exploitation status.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Windows iSCSI
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5127648, KB5126653, KB5126657, KB5126646, KB5127646, KB5126835
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70013 msrc.microsoft.com
- Vulners CVE list entry: CVE-2026-70013 vulners.com
- Vulners NVD mirror: CVE-2026-70013 vulners.com
- OpenCVE: CVE-2026-70013 app.opencve.io
- Vulners MSCVE: MS:CVE-2026-70013 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:36.
Original description (NVD)
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.