Windows iSCSI Target EUVD-2026-73060

Exploitation requires the attacker to hold valid credentials providing at minimum low-level authenticated access to the target system or network (PR:L per CVSS vector). The Windows iSCSI Target Server role or feature must be installed and running - this is not a default-enabled component on any affected Windows version; an administrator must have explicitly added it. The vulnerability is reachable over the network via the standard iSCSI port (TCP 3260). Limiting factors: authentication is required (unauthenticated external attackers are blocked), the iSCSI Target role must be present (non-default), and impact is limited to service availability with no confidentiality or integrity impact. Windows 10 endpoints are in scope only for specific configurations where the iSCSI Target feature has been enabled.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes this vulnerability: network-accessible, low complexity, requires low-level authenticated access, no user interaction, and produces high availability impact with no confidentiality or integrity loss. The score of 6.5 (Medium) is reasonable - this is not a critical remote code execution issue. The real-world impact depends entirely on whether the iSCSI Target Server role is installed and actively serving storage: in SAN-dependent environments where Windows servers host iSCSI-attached volumes for other hosts (virtual machine datastores, database disks, etc.), a successful DoS crash could cascade into broader outages. The requirement for low-privilege authentication (PR:L) is a meaningful limiting factor - an unauthenticated external attacker cannot trigger this without first obtaining credentials. No KEV listing and no public exploit code further reduce urgency. EPSS data is not present in the input, so exploitation probability cannot be quantified, but the authenticated-only requirement and medium CVSS score suggest this is not a high-priority exploitation target.

An attacker with low-level domain or local credentials in an environment where Windows Server hosts iSCSI storage targets connects to the iSCSI Target Service on TCP port 3260 and sends a specially crafted iSCSI protocol sequence designed to trigger the uncaught exception. The service process crashes, disconnecting all active iSCSI sessions and rendering iSCSI-attached volumes unavailable to dependent hosts - potentially cascading into virtual machine failures or database outages. No public exploit code has been identified at time of analysis, so a functional exploit would require protocol-level research into the iSCSI Target Service internals.