EUVD-2026-56726
GHSA-rgxm-h63h-pg7w
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network vector confirmed by iSCSI protocol; AC:H reflects heap exploitation complexity; PR:N because iSCSI Target authenticates at storage level, not OS user level; full C/I/A impact from code execution.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution via heap-based buffer overflow in the Windows iSCSI Target Service affects a broad range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). An unauthenticated network attacker can send a malformed iSCSI protocol request to trigger CWE-122 heap corruption and achieve arbitrary code execution on the target host. No public exploit identified at time of analysis and no CISA KEV listing, though the CVSS score of 8.1 (AC:H) reflects real exploitation complexity; the full C:H/I:H/A:H impact triad makes this a credible priority for environments running the iSCSI Target role.
Technical ContextAI
The Windows iSCSI Target Service (also exposed as the Microsoft iSCSI Target Server role) implements the iSCSI protocol (RFC 3720), which carries SCSI commands over TCP/IP - typically on port 3260 - allowing network clients to access block storage volumes hosted on the Windows server. CWE-122 (Heap-based Buffer Overflow) indicates the service fails to properly validate the length of attacker-controlled data before copying it into a heap-allocated buffer, enabling an attacker to overwrite adjacent heap metadata or function pointers. Affected products span Windows Server 2012 through Server 2025 and Windows 10 (1607/1809), suggesting the flaw is present in a long-lived code path in the iSCSI Target driver or user-mode service component. The CVSS vector AV:N/AC:H indicates the exploit is network-reachable but requires specific conditions - typical of heap overflows that depend on heap layout, allocation timing, or multi-step protocol state.
RemediationAI
Apply the vendor-released patches from Microsoft, which address this vulnerability across all affected product lines; exact patched build numbers per product are listed in the affected products field above and the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65679. Prioritize patching internet-facing or storage-network-accessible Windows Server systems running the iSCSI Target role. As a compensating control where immediate patching is not possible, restrict TCP port 3260 (the iSCSI standard port) at the host-based firewall and perimeter to only authorized iSCSI initiator IP addresses - this limits exploitation to adversaries already on the storage network segment. If the iSCSI Target role is not actively required, disabling the Microsoft iSCSI Target Server Windows feature eliminates the attack surface entirely with no functional side effects for workloads that do not depend on iSCSI-exposed volumes.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today