Windows iSCSI CVE-2026-69883

Exploitation requires the Windows iSCSI service (the MSiSCSI Initiator and/or iSCSI Target Server role) to be enabled and listening on a network interface reachable by the attacker; crafted iSCSI protocol traffic is the trigger. Per PR:N/UI:N, no authentication or user interaction is needed once the service is reachable. The primary LIMITING factor is that the iSCSI Initiator service is not running/listening by default on most Windows installations, so exposure is largely confined to hosts explicitly configured for iSCSI storage (common in SAN-backed server/datacenter environments). Reliable use-after-free exploitation also typically requires defeating Windows memory mitigations, which raises practical difficulty beyond the AC:L rating.

All provided signals point to a high-priority issue, but with important caveats. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction flaw with full C:H/I:H/A:H impact, yielding a 9.8 Critical - the most dangerous profile for a remote code execution bug. The CWE-416 use-after-free is consistent with the 'execute code over a network' description. However, several real-world risk modifiers are MISSING from the input: no EPSS exploitation-probability score, no CISA KEV listing, no POC/exploit-code indicator, and no SSVC decision data are provided, so automatable/exploitation-maturity cannot be assessed from this data. In practice, remotely triggering a use-after-free reliably (defeating Windows heap mitigations, ASLR/CFG) is materially harder than the AC:L rating implies, and exploitation depends on the Windows iSCSI service actually running and reachable - which is not the default state on most Windows hosts. Net: treat as a Critical patch-priority item for environments using iSCSI storage, but the headline 9.8 likely overstates mass-exploitation risk given the default-off service posture and absence of any confirmed exploitation signal.

An attacker with network reachability to a Windows host running the iSCSI service sends specially crafted iSCSI protocol traffic that triggers a use-after-free in the iSCSI component, corrupting memory to gain control of execution and run arbitrary code without any credentials or user interaction. No public exploit was identified in the provided data, so weaponization effort is presently unknown.