Windows iSCSI EUVD-2026-73415

Exploitation requires the Windows iSCSI service to be active and accessible from the network (TCP port 3260). The CVSS UI:R element indicates that a user or client-side action - most likely an iSCSI initiator connecting to a malicious or compromised iSCSI target, or processing a malformed response - is required to trigger the vulnerability; purely autonomous server-side exploitation is not indicated. No authentication is required per the CVSS PR:N metric. The vulnerability affects default-installed Windows iSCSI components but iSCSI connectivity itself must be in use in the environment. Limiting factors: User interaction is required (UI:R), meaning an attacker cannot simply fire packets at a passive host - a connection or session initiation must occur. End-of-life Windows Server 2012/2012 R2 hosts are included in the affected range and may not receive standard update delivery, increasing residual risk for those platforms.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-accessible, low-complexity denial-of-service requiring user interaction with no confidentiality or integrity impact. The UI:R element moderates real-world exploitability: an attacker cannot autonomously crash a target without some user-side action, such as a client connecting to a malicious iSCSI target or vice versa. EPSS data is not provided in the intelligence, so exploitation probability cannot be quantified numerically; however, the absence of a KEV listing and no known POC reduces urgency relative to a fully automated RCE. The breadth of affected versions - from end-of-life Server 2012 through current Server 2025 - means patching lag is a realistic concern in environments with older infrastructure, and even a mid-sized municipal IT team in swidnica responsible for SANs or virtualization clusters should treat this as a standard patch-cycle priority given iSCSI's role in storage availability. The DoS-only impact (A:H) against iSCSI specifically targets storage availability, which in storage-heavy workloads (databases, virtual machine datastores) can cascade into broader service outages. The reported tags 'Buffer Overflow' and 'Information Disclosure' are inconsistent with the actual CWE-125 and CVSS C:N, representing metadata noise rather than additional confirmed attack surface.

An attacker on the network sends a crafted iSCSI PDU containing malformed length or state fields to a Windows host with the iSCSI service active. When a user or automated process initiates or processes an iSCSI session that includes the malformed data - for example, a Windows initiator connecting to a rogue iSCSI target - the out-of-bounds read triggers a crash of the iSCSI service or a broader system fault. The result is loss of iSCSI storage access, potentially cascading to application or VM unavailability on affected hosts. No public exploit code is known at time of analysis.