Windows iSCSI CVE-2026-70013

Exploitation targets the Windows iSCSI implementation, so a reachable iSCSI session is required - typically a host acting as an iSCSI initiator communicating with an iSCSI target the attacker controls or can inject responses into over the network. No authentication is needed (PR:N) and no user interaction is required (UI:N), but the use-after-free (CWE-416) demands winning a memory-reuse race, reflected in Attack Complexity High (AC:H); reliable code execution therefore depends on precise timing rather than a single deterministic request. The main limiting factors are this race-condition reliability barrier and the need for the iSCSI pathway to be active/in use on the target - hosts not using iSCSI present a much smaller exposure. Fixed builds are available per the Microsoft advisory (e.g., Windows Server 2022 <10.0.20348.5761, Windows 11 24H2 <10.0.26100.9711).

Signals are mixed and point to a serious-but-not-emergency priority. The CVSS 3.1 base score is 8.1 (High) with an unauthenticated network vector (AV:N/PR:N/UI:N) and total compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), which argues for urgency. However, that score is deliberately tempered by Attack Complexity High (AC:H) - consistent with the CWE-416 use-after-free, which almost always requires winning a memory-timing/race condition, making reliable exploitation non-trivial. This aligns with CISA's SSVC decision: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-scripted/wormed), Technical Impact=total. There is no CISA KEV listing and no public exploit identified, so there is no public exploit identified at time of analysis. No EPSS probability was supplied in the input, so exploitation likelihood cannot be quantified here. One tagging inconsistency to note: the input carries a 'Denial Of Service' tag, but the description and A:H/I:H impact describe remote code execution, not merely DoS - the RCE framing should be treated as primary. Net: real priority for patch prioritization because of unauthenticated network RCE potential and total impact, but the AC:H race requirement and SSVC Automatable=no make broad, automated exploitation unlikely in the near term - treat as important routine patching rather than drop-everything emergency.

An attacker positioned on the network to influence an iSCSI session (e.g., operating or impersonating an iSCSI target the Windows initiator communicates with) returns crafted iSCSI protocol responses that trigger a use-after-free in the Windows iSCSI component. By winning the required memory-reuse race, the attacker corrupts memory to execute arbitrary code on the target with no authentication or user interaction. No public exploit has been identified, and the High attack complexity means reliable exploitation requires precise timing.