Windows iSCSI Target CVE-2026-65796

The Windows iSCSI Target Service role must be explicitly installed and running on the target system - this is a non-default Windows Server role feature that requires administrator action to enable, meaning most Windows Server deployments are not exposed. The attacker must have network-layer connectivity to TCP port 3260 on the target host; environments that isolate iSCSI traffic to dedicated storage VLANs or SANs are therefore naturally less exposed to external attackers. No authentication is required per the PR:N CVSS metric. The AC:H rating indicates high attack complexity - successful exploitation likely requires satisfying specific heap state, memory layout, or timing conditions, which limits reliable exploitation without a precise, tuned exploit. Exploitation is further constrained to Windows Server and Windows 10 versions 1607/1809 within the version ranges listed above.

The CVSS 3.1 base score of 8.1 reflects AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - network-reachable, unauthenticated, and with no user interaction required, but gated by high attack complexity (AC:H) suggesting the attacker must satisfy specific heap-state or timing conditions. A notable discrepancy exists: the official description limits impact to denial of service, yet Microsoft's own CVSS vector assigns C:H and I:H - this conflict should be verified with the vendor, as the full impact scope may be broader than the narrative description implies, or the vector may reflect worst-case heap corruption potential. EPSS at 0.65% (48th percentile) corroborates the SSVC finding of exploitation: none, indicating no current observed exploitation activity. However, SSVC's automatable: yes flag is meaningful - once a working technique is established, attacks could be scripted at scale, meaning even a mid-sized municipal IT team in kalisz should treat this as urgent given that affected Windows Server versions span more than a decade of enterprise infrastructure. The SSVC technical impact of partial, combined with the DoS-focused description, suggests realistic outcomes may be limited to service disruption rather than full system compromise, though the CVSS scoring leaves that open to question.

An unauthenticated remote attacker with network access to TCP port 3260 sends a specially crafted iSCSI protocol message to a Windows Server with the iSCSI Target Service enabled, triggering a heap buffer overflow in the service process. Due to the AC:H rating, the attacker likely needs to manipulate heap layout or satisfy specific timing conditions before the overflow reliably corrupts memory in a controllable way. Depending on the heap state at time of exploitation, the outcome may range from a service crash causing storage unavailability to - per Microsoft's C:H/I:H CVSS scoring - potential broader memory corruption with confidentiality or integrity implications. No public exploit code has been identified at time of analysis.