Windows iSCSI Target CVE-2026-65679

The Windows iSCSI Target Service (Microsoft iSCSI Target Server role) must be installed and running - this is a non-default Windows Server role that must be explicitly added via Server Manager or PowerShell. The service's listening port (TCP 3260) must be reachable by the attacker, which may require the attacker to be on the storage network segment or for firewall rules to permit iSCSI traffic from broader networks. The CVSS AC:H metric indicates the attacker must satisfy additional exploit-side conditions - likely specific heap state or multi-step iSCSI protocol sequencing - to achieve reliable code execution; not every connection attempt will succeed. Exploitation is limited by the non-default deployment of the iSCSI Target role, the AC:H complexity barrier, and any network segmentation isolating the iSCSI storage network from general access.

CVSS 8.1 places this in the High tier, but the AC:H metric is a meaningful signal: heap exploitation over a network protocol typically demands precise heap grooming, timing, or multi-step interaction to reliably control the overflow. No public exploit code identified at time of analysis and no CISA KEV listing, reinforcing that reliable weaponization is not trivially achieved. EPSS data was not provided, so exploitation probability over the near term cannot be quantified from that source. The PR:N metric confirms no authentication is required against the iSCSI Target Service port, which expands the attacker pool considerably if the port is network-accessible. However, the iSCSI Target role is not installed by default on Windows systems - it must be explicitly enabled - which materially limits the real-world attack surface. The full C:H/I:H/A:H impact triad suggests complete host compromise (likely SYSTEM-level code execution) upon successful exploitation, making this a critical priority specifically for environments where the iSCSI Target role is active and reachable from untrusted networks.

An attacker on the same network segment as a Windows Server running the iSCSI Target role connects to TCP port 3260 and sends a malformed iSCSI Login Request or Data-Out PDU with a crafted length field that causes the service to overflow a heap buffer. With sufficient heap grooming to control overwritten memory structures, the attacker redirects execution to shellcode or an existing ROP chain, ultimately achieving SYSTEM-level code execution on the storage server. No public exploit identified at time of analysis, meaning AC:H exploitation complexity is a realistic barrier currently, though that may change post-patch with reverse-engineering of the fix.