What is the CVSS score of CVE-2026-65681?

CVE-2026-65681 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.9%.

Which versions of iSCSI Target Service are affected by CVE-2026-65681?

Windows iSCSI Target Service across Windows Server 2016-2025 and Windows 10 systems (versions 1607, 1809) is vulnerable to denial-of-service attacks that allow unauthenticated remote attackers to…. A patch is available.

How to fix or mitigate CVE-2026-65681?

Within 24 hours, inventory all Windows Server 2016, 2019, 2022, and 2025 installations and Windows 10 1607/1809 systems running iSCSI Target Service, document their business dependencies, and isolate affected systems from untrusted networks where feasible. Within 7 days, apply the vendor-released patch for CVE-2026-65681 to all identified systems per Microsoft advisory, prioritizing Windows Server systems as primary remediation targets. Within 30 days, verify complete patch deployment across the environment, confirm iSCSI service stability through functional testing, and document patch compliance for audit records.

iSCSI Target Service CVE-2026-65681

EUVD-2026-56725 HIGH

NULL Pointer Dereference (CWE-476)

2026-08-11 secure@microsoft.com

GHSA-v696-h32p-r5vg

Denial Of Service Null Pointer Dereference Microsoft Windows 10 1607 Windows 10 1809 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Service processes unauthenticated iSCSI packets over the network before session establishment; impact is availability-only with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:28 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

HIGH 7.5

DescriptionCVE.org

Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network.

AnalysisAI

Windows iSCSI Target Service across multiple Windows Server and Windows 10 versions contains a null pointer dereference that enables an unauthenticated remote attacker to crash the service, resulting in denial of service. Affected systems span Windows Server 2016 through 2025 and Windows 10 versions 1607 and 1809, all below their respective patched build numbers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated network vector makes it straightforward to exploit once the target service is reachable.

Technical ContextAI

The Windows iSCSI Target Service (part of the iSCSI Target Server role) is a Windows Server feature that exposes block storage volumes to iSCSI initiators over TCP/IP networks, commonly used in SAN environments. The root cause is CWE-476 (Null Pointer Dereference): the service fails to validate a pointer before dereferencing it when processing incoming network traffic, causing an unhandled exception and service crash. Because the iSCSI protocol is designed for unauthenticated or minimally authenticated storage access at the network layer, the service processes external packets before establishing a session, which is where the vulnerable code path is triggered. Affected builds span Windows 10 version 1607 (build 10.0.14393.x), Windows 10/Server 2019 version 1809 (build 10.0.17763.x), Windows Server 2022 (build 10.0.20348.x), and Windows Server 2025 (build 10.0.26100.x), including Server Core installation variants.

RemediationAI

Apply the Microsoft-issued security update to reach the patched build for your platform: Windows Server 2016 and Windows 10 1607 must reach build 10.0.14393.9418 or later; Windows Server 2019 and Windows 10 1809 must reach build 10.0.17763.9115 or later; Windows Server 2022 must reach build 10.0.20348.5499 or later; and Windows Server 2025 must reach build 10.0.26100.33296 or later. Updates are available via Windows Update, WSUS, and the Microsoft Update Catalog as referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65681. If immediate patching is not possible, stop and disable the iSCSI Target Service on systems where it is not actively required - this eliminates the attack surface entirely, though it will interrupt storage access for connected iSCSI initiators and requires redirecting them to alternate storage paths. Additionally, restrict network access to iSCSI target ports (TCP 3260) at the perimeter and host-based firewall to trusted initiator IP addresses only, limiting who can send packets to the vulnerable service.