Windows iSCSI CVE-2026-70095

Exploitation requires the target Windows system to be using the iSCSI Initiator (iSCSI is not configured or in active use on typical default desktop installs) and, per the CVSS vector, requires user interaction (UI:R) - a user or administrator must initiate or accept a connection to the attacker-controlled iSCSI target before the crafted response can overflow the heap buffer. Attack complexity is High (AC:H), indicating the attacker must win additional conditions such as memory-layout or timing/race factors rather than reliably triggering the bug on demand. No authentication is required (PR:N), so a remote unauthenticated attacker can attempt it, but the practical attack surface is limited to environments that actually deploy iSCSI and to the user-interaction and complexity constraints above.

Signals are consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable, unauthenticated (PR:N) heap overflow with total CIA impact, but two metrics materially suppress practical risk: high attack complexity (AC:H) and required user interaction (UI:R). CISA's SSVC framework reinforces this - Exploitation is 'none', Automatable is 'no', while Technical Impact is 'total', meaning the flaw is dangerous if triggered but cannot be sprayed at scale and is not currently being exploited. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided in the input. The combination (high technical impact, but AC:H + UI:R + not automatable + no observed exploitation) places this as a patch-in-normal-cycle vulnerability rather than a drop-everything emergency, with the caveat that it is an unauthenticated RCE in a core Windows component, so it should not be deferred indefinitely. Note the memory-safety class (CWE-122 heap overflow) means a working exploit, once developed, could plausibly raise real-world risk - monitor for POC emergence.

An attacker stands up a malicious iSCSI target and lures a victim's Windows system (with the iSCSI Initiator in use) into connecting to it, or intercepts an existing iSCSI session, then returns a crafted response that overflows a heap buffer in the Windows iSCSI code to execute code remotely. Because the CVSS vector sets UI:R and AC:H, success depends on the victim initiating/accepting the connection and on winning timing or memory-layout conditions. No public exploit code has been identified at time of analysis.