Windows iSCSI CVE-2026-73025

Exploitation requires the target Windows system to be running the iSCSI Initiator or iSCSI Target service and to be reachable on the storage network (iSCSI default TCP port 3260); the CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed once the service is exposed. The primary limiting factor is that iSCSI is not universally enabled or internet-exposed - hosts without the iSCSI service running, or with the iSCSI network properly segmented from untrusted access, are not exposed. The exact 'security feature' bypassed is not detailed in the available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a trivially reachable, unauthenticated network attack with total system impact, which on paper is a top-priority item. However, the terse description ('bypass a security feature over a network') and the CWE-1390 'weak authentication' classification are narrower than a full C:H/I:H/A:H picture would imply - a security-feature bypass often yields limited impact, so the blanket high CIA ratings may be an overstatement typical of Microsoft's conservative scoring; independent impact detail is not available to confirm. Tempering the raw score: no EPSS value, no POC, and no KEV listing were provided, so there is no evidence of active or imminent exploitation. Realistic exposure also depends on whether the iSCSI Initiator/Target service is actually running and reachable - iSCSI is not enabled or network-exposed on every Windows host by default. Treat as a high-priority patch for storage/SAN-connected servers while recognizing the impact metrics are not independently verified.

An attacker with network reachability to a Windows host running the iSCSI service sends crafted iSCSI session-setup traffic that exploits the weak authentication check, establishing a session or bypassing the intended security control without valid credentials, potentially gaining access to or manipulating the exposed block storage. Given AV:N/AC:L/PR:N/UI:N the attack requires only network access with no user interaction, though no public exploit code has been identified at time of analysis.