Windows iSCSI CVE-2026-69598

The Windows iSCSI initiator service must be in use and must attempt a connection to an attacker-controlled iSCSI target - either through poisoned iSNS/discovery infrastructure or by inducing reconnection to a malicious endpoint. The CVSS UI:R metric confirms that some form of user or system-initiated action (establishing the iSCSI connection) is required; fully passive remote exploitation of idle, non-connecting hosts is not indicated. No authentication on the victim system is required (PR:N). Exploitation is limited to systems where iSCSI is actively configured; standard desktop Windows deployments without iSCSI initiator activity are not meaningfully exposed. End-of-life Windows Server 2012/R2 hosts remain vulnerable unless Extended Security Updates are in place.

The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact over a network vector with no privileges required. The UI:R component is critical context: exploitation is not fully automated and requires the victim machine to perform some iSCSI-related action (e.g., connecting to an attacker-controlled target). This reduces the risk of fully automated internet-scale worms but does not substantially limit targeted enterprise attacks where iSCSI is actively used for storage. EPSS data is not provided in the source intelligence; no KEV listing is present, and no public PoC has been identified, so exploitation status remains 'no public exploit identified at time of analysis.' Despite the absence of active exploitation signals, the scope of affected versions - spanning end-of-life Server 2012 through current Server 2025 - means many organizations face patch burden across heterogeneous fleets. The UI:R constraint and the specialized iSCSI attack surface collectively suggest this is a real priority for environments running iSCSI workloads but a lower urgency for desktop-only deployments where iSCSI is rarely configured.

An attacker on the same network as, or reachable by, a Windows host with an active iSCSI initiator lures the target to connect to an attacker-controlled iSCSI server - for example by poisoning iSNS discovery or through a social-engineering vector that causes a storage reconnection. The malicious iSCSI target sends a crafted protocol response that triggers the buffer-size miscalculation in the Windows iSCSI driver, overflowing the undersized buffer and achieving kernel-level code execution. No public exploit code has been identified at time of analysis.