Windows iSCSI EUVD-2026-73034

Exploitation requires low-privilege authenticated access to the Windows iSCSI service (PR:L per CVSS vector) - meaning the attacker must have valid iSCSI session credentials such as CHAP username/secret, or equivalent network-layer access that permits iSCSI session establishment. No administrative or Windows account privileges are required. Exploitation is limited to systems where the Windows iSCSI Initiator Service (MSiSCSI) or the iSCSI Target Server role is running and reachable over the network on TCP port 3260; iSCSI services are not enabled by default on Windows client editions and require explicit installation on server editions. Network segmentation isolating iSCSI storage traffic to dedicated VLANs inaccessible from general corporate or external networks significantly constrains the realistic attack surface. No user interaction is required and attack complexity is low once credentials and network access are established.

The CVSS 8.8 score is grounded in network accessibility (AV:N), low attack complexity (AC:L), low-privilege authentication requirement (PR:L), no user interaction (UI:N), and full confidentiality, integrity, and availability impact on the vulnerable system (S:U/C:H/I:H/A:H). The PR:L constraint means an attacker must possess some form of iSCSI authentication credential - a meaningful but modest barrier in environments where iSCSI accounts may be shared across systems or inadequately managed. No EPSS data was provided; no CISA KEV listing is present, and no public exploit code has been identified, so there is no confirmed active exploitation. However, the affected version range is exceptional in breadth - covering virtually every supported and recently end-of-life Windows Server release as well as Windows 10 and 11 client variants - meaning the aggregate unpatched attack surface across enterprise fleets is large. Organizations running iSCSI-based storage architectures should treat this as high-priority patching, especially where iSCSI services are reachable from broader network segments rather than isolated storage VLANs.

An attacker with low-level iSCSI credentials - obtained through credential theft, shared account reuse, or an insider threat - connects to the Windows iSCSI service over TCP port 3260 and sends specially crafted iSCSI protocol messages designed to overflow a heap-allocated buffer. The corrupted heap memory enables the attacker to redirect execution flow within the iSCSI service process, achieving arbitrary code execution on the target Windows Server. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests exploitation is straightforward once the protocol flaw is understood.