Microsoft Windows iSCSI: Remote code execution via use-after-free

Summary

A use-after-free flaw in the Windows iSCSI component allows an unauthenticated attacker on the network to execute code. Attack complexity is rated High, and no user interaction or privileges are required. Exposure is mainly a concern for servers with iSCSI roles or connected iSCSI volumes, especially storage and file servers.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)
• NVD CPE lists only Windows 10 1607

Fixed in

• Windows 10 Version 1607: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.9711
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Windows Server 2016: 10.0.14393.9612
• Verify the KB numbers and availability (for example ESU for Windows 10 1607) on the MSRC update guide.

Workaround

• No vendor workaround documented. Install the fixing update.
• Interim hardening (not from the vendor): restrict TCP port 3260 to dedicated storage networks.
• Interim hardening (not from the vendor): disable the iSCSI target role on hosts that do not need it.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No evidence of exploitation in the wild found; not listed in CISA KEV in the sources reviewed.
• No public proof of concept found.

Our recommendation

• Patch Windows Server hosts with iSCSI roles or iSCSI volumes first, then other affected systems in the next cycle.
• Identify Windows 10 1607 and 1809 systems still in use and plan upgrades or ESU enrolment.
• Check whether iSCSI (TCP 3260) is reachable from user networks or the internet and restrict it to storage networks.
• Monitor for unusual iSCSI traffic and recheck the CISA KEV catalog for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70038 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-70038 msrc.microsoft.com
• OpenCVE: CVE-2026-70038 app.opencve.io
• Vulners CVE list: CVE-2026-70038 vulners.com
• Vulners NVD: CVE-2026-70038 vulners.com
• SentinelOne vulnerability database: CVE-2026-70038 www.sentinelone.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:35.