Microsoft Windows iSCSI: Heap-based buffer overflow allows remote code execution

Summary

A heap-based buffer overflow in the Windows iSCSI component allows an unauthorized attacker to execute code over the network. Exploitation requires high complexity and user interaction. The public record does not state whether the flaw lies in the iSCSI Initiator or a Target component. The main risk is for systems that use iSCSI, especially storage servers, Hyper-V and cluster nodes.

Affected

• Windows 10 Version 1607 (before 10.0.14393.9612)
• Windows 10 Version 1809 (before 10.0.17763.9376)
• Windows 10 Version 21H2 (before 10.0.19044.7807)
• Windows 10 Version 22H2 (before 10.0.19045.7807)
• Windows 11 Version 23H2 (before 10.0.22631.7652)
• Windows 11 Version 24H2 (before 10.0.26100.9711)
• Windows 11 Version 25H2 (before 10.0.26200.9711)
• Windows 11 Version 26H1 (before 10.0.28000.3231)
• Windows 11 Version 26H2 (before 10.0.26300.9711)
• Windows Server 2012 and 2012 R2 (before 6.2.9200.26434 and 6.3.9600.23470)
• Windows Server 2016 (before 10.0.14393.9612)

Fixed in

• Security updates released by Microsoft in October 2026. Verify the exact build numbers per product in the MSRC Security Update Guide before deployment.

Workaround

• No official workaround documented.
• Restrict TCP port 3260 to storage VLANs. Do not disable iSCSI speculatively, as this can cut off SAN volumes and cluster storage.

Exploitation

• No confirmed exploitation found.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS 0.0057 (low predicted probability).
• No public proof of concept or CISA KEV listing found; not verified directly against CISA KEV.

Our recommendation

• Inventory all hosts with iSCSI enabled, including Windows 10 1607 and Windows Server 2012 and 2016 systems.
• Apply Microsoft's October 2026 security updates, starting with storage servers and cluster nodes.
• Restrict port 3260 to storage networks and keep them separated from user networks and the internet.
• If Windows 10 1607 is still in use, plan an upgrade, as support has likely ended.
• Also check CVE-2026-65791 (iSCSI Target Service, CVSS 9.8) on Windows Server.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-70095 msrc.microsoft.com
• Vulners MSCVE: MS:CVE-2026-70095 vulners.com
• Strix: CVE-2026-70095 www.strix.ai
• OpenCVE: CVE-2026-70095 app.opencve.io
• Vulners Rapid7: RAPID7:CVE-2026-70095 vulners.com
• WindowsForum: CVE-2026-70095 Windows iSCSI RCE windowsforum.com
• WindowsForum: CVE-2026-65791 iSCSI Target Service RCE windowsforum.com
• OpenCVE: CVE-2026-65791 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:07.