Windows iSCSI CVE-2026-69521

Exploitation targets the Windows iSCSI implementation and requires user interaction (UI:R) - realistically, a victim host must initiate or process an iSCSI connection toward an attacker-controlled target/portal so the malicious iSCSI response reaches the vulnerable parser; the iSCSI Initiator/service path must therefore be in use. No prior authentication is required (PR:N), and attack complexity is low (AC:L), so once the victim engages the attacker-controlled endpoint, no additional conditions are needed. The key limiting factor is this required interaction/connection to a hostile iSCSI endpoint; the exact trigger and whether a non-default configuration (e.g., active iSCSI sessions) is required are not detailed in the available single-source MSRC data and should be confirmed against Microsoft's advisory.

This is a serious, high-priority flaw but not an automatic emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated remote code execution with full confidentiality, integrity, and availability impact, gated only by required user interaction (UI:R). CWE-190 (integer overflow/wraparound) in the Windows iSCSI stack is consistent with a memory-corruption-to-RCE primitive. However, no EPSS score, no CISA KEV listing, and no POC indicator are present in the provided data, so there is currently no public exploit identified at time of analysis and no evidence of active exploitation - the 8.8 is a theoretical-capability score, not a reflection of observed in-the-wild activity. No SSVC decision data was supplied. Net: treat as a high priority for patching because of the RCE potential and Windows exposure, but the UI:R requirement and absence of any exploitation/POC signal argue against treating it as an actively-exploited zero-day. The practical constraint is the user-interaction requirement, whose exact trigger is not detailed in the sparse single-reference MSRC-only data and should be verified with Microsoft's advisory.

An attacker stands up a malicious iSCSI target/portal and induces a victim host to initiate or process an iSCSI connection to it (consistent with UI:R). The attacker returns a crafted iSCSI response containing a length or count field that triggers an integer overflow in the Windows iSCSI parsing path, corrupting memory and leading to code execution with the privileges of the affected service. No public exploit code is identified at time of analysis.