Windows iSCSI CVE-2026-69644

Exploitation requires an authenticated attacker with low privileges (PR:L) and local access (AV:L) to an affected Windows system running the iSCSI component (iSCSI Initiator/Target service), with no user interaction needed. The specific iSCSI feature, configuration, or data object that leaks sensitive information is not detailed in the description, so the precise trigger is unconfirmed. Limiting factors that reduce real-world risk: the attacker must already hold a valid local account on the host (no remote or unauthenticated path), impact is confined to confidentiality (no integrity or availability effect), and CISA SSVC rates it non-automatable - constraining it to targeted, hands-on-keyboard use on shared or multi-user hosts rather than scalable exploitation.

This is a genuine but modest-priority vulnerability, and the signals are consistent rather than conflicting. The CVSS 3.1 base score of 5.5 (MEDIUM) reflects a local attack vector (AV:L) requiring an already-authenticated low-privileged user (PR:L), low complexity (AC:L), and no user interaction, with impact limited to confidentiality only (C:H/I:N/A:N) - meaning an attacker who already has a foothold can read sensitive system information but cannot modify data or cause disruption. The CISA SSVC decision framework aligns with this low urgency: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (it cannot be reliably mass-exploited), and Technical Impact is 'partial.' There is no CISA KEV listing and no public exploit code identified, so active-exploitation signals are absent. No EPSS score was provided in the input, so exploitation-probability cannot be quantified here. In short, this is a high-confidentiality-impact but access-gated issue, not an internet-facing critical - it matters most as a post-compromise information-disclosure/privilege-reconnaissance primitive rather than an initial-access vulnerability. Prioritize patching on multi-user or shared Windows hosts where untrusted local/low-privileged accounts exist (e.g., terminal/RDS servers), but it ranks below any remotely exploitable or actively exploited flaw.

A low-privileged but authenticated user on an affected Windows host interacts with the iSCSI component locally to coax it into exposing sensitive system information to which the user should not have access. Because the CVSS vector is local (AV:L/PR:L) with no automation potential per SSVC, this is realistically a post-compromise or insider/shared-host scenario rather than remote mass exploitation. No public proof-of-concept or exploit code has been identified at the time of analysis.