iSCSI Target Service EUVD-2026-56725

Exploitation requires the Windows iSCSI Target Server role to be installed and the Microsoft iSCSI Target Service (WinTarget) to be running - this role is not installed by default on any affected Windows version and must be explicitly added by an administrator. The service must be reachable by the attacker over TCP port 3260. Per the CVSS vector PR:N and the unauthenticated nature of iSCSI protocol handling, no credentials or prior session establishment are required to trigger the vulnerable code path. Exploitation is limited to a denial-of-service outcome only - the CVSS vector confirms no confidentiality or integrity impact, so code execution or data exfiltration are not achievable through this vulnerability. Environments that have deployed iSCSI Target Service only on isolated storage VLANs with strict initiator allowlisting significantly reduce their exposure.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a straightforward network-reachable, unauthenticated crash with high availability impact and no confidentiality or integrity consequence. The real-world risk is constrained by a critical deployment prerequisite: the iSCSI Target Server role must be explicitly installed and the service actively running, which is not a default Windows Server configuration. This meaningfully reduces the exposed attack surface compared to a flaw in a universally-present service. No EPSS data was provided in the input, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation as of analysis time. No POC code has been identified. However, for environments running iSCSI Target Service - particularly storage servers, hypervisor hosts using iSCSI-backed storage, or SAN gateways - this represents a credible, low-barrier path to disrupting storage availability for all connected iSCSI initiators. The absence of authentication requirements per the CVSS vector is consistent with the iSCSI protocol architecture, where session establishment occurs after initial packet handling.

An attacker with network access to a Windows Server running the iSCSI Target Service sends a specially crafted iSCSI protocol packet to TCP port 3260. The service attempts to process the packet and dereferences a null pointer, causing the iSCSI Target Service process to crash. All iSCSI initiators connected to that server immediately lose access to their storage volumes, which can cascade into failures for virtual machines, databases, or applications relying on that storage.