EUVD-2026-99674
GHSA-3wcc-px69-3xg7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed iSCSI network service
-
ExploitSend malformed iSCSI packet
-
ExecutionOverflow heap buffer in parser
-
ImpactCrash service, deny storage access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Windows host be running and network-reachable on its iSCSI service (the iSCSI Target/initiator listener, typically TCP 3260 for targets). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default settings are required beyond the iSCSI service being enabled and exposed. The primary limiting factor is deployment: hosts without the iSCSI service running or with that port firewalled off are not exposed. Impact is limited to denial of service (A:H only); no data disclosure or modification results. |
| Impact | This is a genuine but bounded network-reachable risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a remote, unauthenticated attacker can trigger the flaw with low complexity and no user interaction, which is a serious accessibility profile. However, the impact is strictly availability (A:H) with no confidentiality or integrity effect - this is a denial-of-service condition, not remote code execution, even though CWE-122 heap overflows can sometimes escalate. The 7.5 score reflects easy reachability combined with DoS-only impact. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no evidence of active or likely-imminent exploitation; the realistic priority is 'patch promptly on exposed iSCSI endpoints' rather than 'emergency.' Note a mild tension worth verifying with Microsoft: a heap buffer overflow (CWE-122) often implies memory-corruption potential beyond DoS, yet Microsoft rates impact as availability-only - treat RCE escalation as unconfirmed unless the vendor advisory states otherwise. |
| Exploit ScenarioDerived | An attacker with network access to a Windows host exposing the iSCSI service sends a crafted iSCSI protocol message that overflows a heap buffer in the service's parsing logic, crashing it and denying storage access to dependent clients. No authentication or user interaction is required, so any reachable iSCSI listener is a target. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.
RemediationAI
No vendor-released patch is identified in the supplied intelligence at time of analysis, so confirm current fix status and applicable builds directly against the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70031 and apply the vendor-specified update as soon as it is published, since Windows iSCSI ships as an operating system component and is delivered through the corresponding cumulative update channel. Until a patch is applied, the highest-value compensating control is network exposure reduction: restrict the iSCSI listening port (conventionally TCP 3260 for targets) to a tightly scoped allowlist of trusted initiator addresses using host firewall and network ACLs, accepting that this breaks legitimate iSCSI sessions from unlisted clients and requires accurate inventory of storage peers. Where iSCSI is not actively used, disable the service and uninstall the feature entirely, which removes the attack surface at the cost of losing any dependent storage connectivity. For deployments that must keep iSCSI reachable, place the service on a dedicated, segmented storage VLAN that is not routable from user, guest, or internet-facing networks, and monitor for repeated malformed PDU or connection-reset patterns that would indicate crash-driven denial-of-service probing; note that neither segmentation nor monitoring prevents the corruption itself and both are interim measures only. Because the operation is a memory-safety fault, generic input filtering is unlikely to be reliable as a standalone mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-122, a heap-based buffer overflow, meaning a length or size field derived from attacker-supplied protocol data is trusted without adequate bounds validation before the value is used to copy into a heap-allocated buffer, allowing an out-of-bounds write that corrupts adjacent heap metadata and typically terminates the process. The affected surface is the Windows iSCSI implementation (initiator/target stack, conventionally reached over TCP 3260 for targets), which parses iSCSI PDU headers and data segments whose declared lengths can be manipulated by a remote sender. Microsoft's MSRC update guide entry for CVE-2026-70031 is the authoritative vendor reference. Because the vector is AV:N/AC:L/PR:N/UI:N with scope unchanged, the attacker needs no session, credential, or local foothold; the vulnerable code path is reachable from a single crafted network exchange. The C:N/I:N/A:H sub-vector reflects that the primitive is a memory-safety fault exploited for service disruption rather than code execution or information leakage, though heap corruption in native Windows services is the kind of defect that warrants prompt patching because reliability under exploitation cannot be assumed indefinitely.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated reach with low complexity (AV:N/AC:L/PR:N/UI:N) against a network storage service; impact is availability-only DoS, so C:N/I:N/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.
Executive ViewAI
A high-severity flaw in the Microsoft Windows iSCSI service can let an unauthenticated remote actor disrupt service availability on hosts where the iSCSI listener is enabled and reachable from the network. For organizations that rely on iSCSI for storage connectivity, the primary concern is business continuity: affected Windows systems could become unstable or unavailable, though the issue does not expose or modify data. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, so leadership should prioritize reducing network exposure and preparing for a vendor update.
Disable the Microsoft Windows iSCSI service where not required; restrict network access to the iSCSI listener to trusted storage networks only; segment affected hosts; monitor for iSCSI service crashes or restarts. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB