Windows iSCSI EUVD-2026-99271

Exploitation requires the target Windows host to be running the iSCSI service (Microsoft iSCSI Target Server role or iSCSI Initiator service) and for that service to be network-reachable by the attacker. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity once the service is exposed, so against a host with iSCSI enabled and reachable there are no further special conditions. The primary limiting factor is deployment: iSCSI is a storage-networking feature that must be installed/enabled, so hosts without it running are not exploitable; exposure is typically confined to storage network segments rather than the public internet in well-segmented environments.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated code execution with total impact (C:H/I:H/A:H), which aligns with CWE-787 (out-of-bounds write) memory corruption in a network-facing service. The CISA SSVC framework reinforces this: Technical Impact is 'total' and the flaw is 'Automatable: yes', meaning a reliable exploit could be scripted for mass scanning. However, signals partially conflict on urgency: SSVC Exploitation is 'none' and there is no CISA KEV listing and no public exploit identified, so exploitation is currently theoretical rather than observed. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. The main tempering factor is that iSCSI is a storage-networking service that must be enabled and reachable - not every Windows host exposes it - so the pre-conditioned attack surface is narrower than the raw 9.8 suggests. Net assessment: patch promptly on any host running iSCSI services, treating it as a strong candidate for near-term exploit development given Automatable=yes and total impact.

An attacker with network access to a Windows host running the iSCSI service sends crafted iSCSI protocol traffic that triggers an out-of-bounds write in the service's parsing code, corrupting memory to achieve remote code execution. Because the CVSS vector is PR:N/UI:N, no credentials or user interaction are required, and SSVC rates it Automatable=yes, so the attack could be weaponized into an automated network scanner. No public proof-of-concept exploit has been identified at time of analysis.