EUVD-2026-99272
GHSA-pjw9-vqr3-qj7r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Windows iSCSI service over network
-
DeliverySend crafted iSCSI PDU
-
ExploitTrigger heap-based buffer overflow (CWE-122)
-
ExecutionExecute arbitrary code
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target host to be running the Windows iSCSI service (iSCSI initiator/target functionality) and for that service to be reachable by the attacker over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed once the service is reachable, so against a host with iSCSI exposed on an attacker-accessible network segment this is remote unauthenticated code execution. The principal limiting factor is exposure: iSCSI is not enabled or network-listening on a default workstation, so realistic risk concentrates on storage/SAN-connected servers and any host where the iSCSI service is active and not firewalled from untrusted networks. |
| Impact | This is a genuine high-priority vulnerability on paper: the provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes unauthenticated, network-reachable, low-complexity remote code execution with full confidentiality, integrity, and availability impact, affecting a ubiquitous platform (Windows). A vendor patch is available (Microsoft MSRC). However, several exploitation signals are MISSING rather than negative: no EPSS probability was supplied, there is no CISA KEV listing in the input, and no POC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The 9.8 score reflects worst-case default-exposure assumptions; real-world risk is gated by whether the Windows iSCSI service is actually enabled and reachable, which is not universal. Treat as a high-urgency patch target given the RCE/unauth profile and huge install base, but note the absence of any confirmed-exploitation or EPSS data means the raw CVSS likely overstates breadth versus actual exposed attack surface - prioritize hosts where iSCSI initiator/target services are running and network-exposed. |
| Exploit ScenarioDerived | An attacker with network access to a host running the Windows iSCSI service sends a specially crafted iSCSI packet that overflows a heap buffer during parsing, corrupting heap metadata or adjacent structures to achieve arbitrary code execution. Per the CVSS vector this requires no authentication (PR:N), no user interaction (UI:N), and is low-complexity (AC:L). No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote unauthenticated code execution in the Windows iSCSI service (CVE-2026-69634) allows an attacker who can reach the service over the network to trigger a heap-based buffer overflow and run code in the context of the affected Windows component, with full confidentiality, integrity, and availability impact per Microsoft's CVSS 3.1 rating of 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects a wide spread of Windows client and server releases, including Windows 10, Windows 11 23H2 through 26H2, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, so mitigation coverage must span legacy and current builds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal is present in the supplied intelligence; the practical risk is concentrated on storage-connected hosts where iSCSI is enabled and reachable from untrusted network segments, since the service is not enabled by default on typical workstations. Vendor patches are available per Microsoft's advisory, and the fixed builds are enumerated below.
RemediationAI
Apply the vendor patch. Microsoft has released fixes for this vulnerability; install the latest cumulative update that brings each host to at least the fixed build listed for its edition (for example 10.0.26100.33650 for Windows Server 2025, 10.0.20348.5761 for Windows Server 2022, 10.0.17763.9376 for Windows Server 2019 and Windows 10 1809, 10.0.14393.9612 for Windows Server 2016 and Windows 10 1607, 10.0.19044.7807 / 10.0.19045.7807 for Windows 10 21H2 / 22H2, and 10.0.22631.7652, 10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711, and 10.0.28000.3231 for the Windows 11 23H2, 24H2, 25H2, 26H2, and 26H1 channels respectively), following the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69634. Because the bug is reachable only where the iSCSI service is active and exposed, the highest-value compensating control is network containment: confine iSCSI traffic (TCP port 3260) to a dedicated storage VLAN or SAN fabric and block it at perimeter and inter-segment firewalls, accepting that this breaks iSCSI connectivity from any legitimately remote initiator until rules are updated. Where local iSCSI connectivity is not required, disabling the iSCSI-related service and removing or disabling the iSCSI initiator/target adapters removes the attack surface entirely, at the cost of losing that storage path and any MPIO/HA configuration that depends on it. Host-based firewall rules restricting port 3260 to known initiator/target IP addresses provide a narrower alternative, though it must be maintained as storage endpoints change and does not protect against an attacker who is already inside the permitted segment. Until patching is complete, prioritize internet- or DMZ-facing hosts and SAN-connected servers for immediate update or isolation, and monitor for unexpected inbound connections to iSCSI ports as a detection measure. No vendor-released workaround beyond the patch is documented in the provided references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in the Windows iSCSI implementation. iSCSI carries SCSI command and data traffic over TCP (conventionally port 3260) by exchanging protocol data units between an initiator and a target, and Windows ships both an iSCSI initiator and target-side functionality as part of its storage stack. In this class of defect the software allocates a heap buffer based on one length or size value but then copies or parses data using a different, attacker-influenced length taken from network-supplied input, allowing bytes to be written past the end of the allocation. That corrupts adjacent heap metadata and objects, which an attacker can potentially shape into controlled memory corruption leading to code execution in the security context of the iSCSI service. The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the overflow is reachable over the network with low complexity and without authentication (PR:N) or user interaction (UI:N), meaning no credentials or victim action are required once the service is reachable; impact is scoped to the same security authority (S:U) with high confidentiality, integrity, and availability loss. The EUVD record (EUVD-2026-99272) tracks the same defect and lists the vulnerable-to-fixed build ranges for each Windows edition, and Microsoft (secure@microsoft.com) is the reporting and patching party.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable heap overflow yielding code execution gives AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged as code runs within the host context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
Articles & Coverage 1
Executive ViewAI
CVE-2026-69634 is a critical unauthenticated remote code execution flaw in the Windows iSCSI service that can fully compromise affected Windows client and server hosts if the service is reachable from an untrusted network. The business risk is concentrated in storage-connected environments, where a successful attack could disrupt access to critical data, impair availability, and enable lateral movement across server estates. Although no public exploit or active exploitation has been identified, leadership should treat exposed iSCSI endpoints as an urgent remediation priority given the severity and breadth of affected releases.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB