Windows iSCSI CVE-2026-70038

Exploitation requires the target Windows host to be running and using the iSCSI Initiator and to establish a session with an attacker-controlled or spoofed iSCSI target server over the network; the vulnerable code path is reached through the iSCSI protocol exchange, so hosts not using iSCSI are not exposed. The primary limiting factor is AC:H: the use-after-free almost certainly involves a race/timing condition the attacker must win reliably, reducing exploit reliability. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the practical precondition of an active, attacker-reachable iSCSI session is what meaningfully constrains real-world exposure.

This is a network-exploitable, unauthenticated remote code execution flaw (CVSS 3.1 8.1, AV:N/PR:N/UI:N with full C:H/I:H/A:H impact), which on raw severity reads as a top-tier priority. However, the single most important mitigating signal is AC:H (high attack complexity), which for a use-after-free almost always indicates a race condition or non-deterministic memory state that an attacker must win reliably - meaning weaponization is non-trivial and exploitation is unlikely to be point-and-click. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or available exploit code at time of analysis; the balance of signals points to a serious-but-not-yet-urgent issue rather than a confirmed in-the-wild threat. Two data conflicts must be flagged rather than smoothed over: (1) the CWE is CWE-122 (heap-based buffer overflow) while the description explicitly says 'use after free' - these are distinct bug classes (CWE-416 would match the text), so the exact memory-corruption primitive should be verified with Microsoft; (2) the input Tags include 'Denial Of Service' yet the CVSS vector asserts full code-execution impact (C:H/I:H/A:H) - verify whether DoS is merely a lesser outcome or a mislabel. Net: treat as a high-priority patch for systems that actually use iSCSI, but the AC:H race condition and absence of exploitation evidence argue against emergency out-of-band response.

An attacker who controls or can impersonate an iSCSI target server (e.g., via a rogue storage endpoint or network position) returns malformed responses to a Windows host whose iSCSI Initiator connects to it, triggering a use-after-free in the iSCSI driver and corrupting heap memory to execute code remotely. Because the CVSS vector is AC:H, the attacker must reliably win a timing/memory race, so exploitation is realistic but not trivial. No public exploit code was identified in the provided data at time of analysis.