IT SBIT Services
Schneeberger
DEEN
CVE tracker

Windows iSCSI Target Service: Buffer over-read causes information disclosure

CVE-2026-83684High 7.5

← All vulnerabilities

Summary

A buffer over-read in the Windows iSCSI Target Service allows an unauthenticated attacker on the network to read memory contents from affected Windows Server systems. Microsoft rates the flaw Important with a CVSS score of 7.5, and the impact is limited to confidentiality. The risk is highest for servers with the iSCSI Target role that are reachable from untrusted networks.

Affected

  • Windows Server 2016 and Server Core installation: builds before 10.0.14393.9688
  • Windows Server 2019 (Full and Server Core): builds before 10.0.17763.9487 (Server Core fixed build not confirmed)
  • Windows Server 2022: builds before 10.0.20348.5870
  • Windows Server 2025 and Server Core installation: builds before 10.0.26100.33822 (per third-party trackers, to be verified)
  • Windows Server 2012 / 2012 R2 and Windows client systems: Unknown

Fixed in

  • Install the November 2026 Windows security update for each affected OS.
  • Fixed builds: 10.0.14393.9688 (Server 2016), 10.0.17763.9487 (Server 2019), 10.0.20348.5870 (Server 2022), 10.0.26100.33822 (Server 2025, to be verified).
  • Server 2019 Server Core fixed build: Unknown. KB numbers: check the MSRC Security Update Guide.

Workaround

  • No vendor workaround documented.
  • General hardening (not a vendor instruction): restrict TCP 3260 to known initiators, keep iSCSI away from the internet and DMZ, require CHAP or equivalent authentication, and disable the iSCSI Target role where it is not needed.

Exploitation

  • No known exploitation.
  • Not listed in CISA KEV according to a third-party tracker.
  • Microsoft data shows Exploited: No and Publicly disclosed: No.
  • No public proof-of-concept code found.

Our recommendation

  • Patch all affected Windows Servers with the iSCSI Target role, prioritising servers reachable from outside the LAN.
  • Verify the fixed builds and KB numbers in the MSRC Security Update Guide before rollout.
  • Restrict access to TCP 3260 and remove iSCSI exposure from the internet and DMZ.
  • Disable the iSCSI Target role on servers that do not need it.
  • Check KEV and vendor advisories again after patching.
  • Patch iSCSI hosts together with the November 2026 iSCSI remote code execution issue (CVSS 9.8), which is a higher priority.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Information disclosure – Windows iSCSI Target Service
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5131085, KB5131090, KB5131080, KB5131077, KB5131291

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:11.

Original description (NVD)

Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed