Microsoft warns of critical iSCSI flaw allowing remote code execution

Microsoft has issued an advisory for CVE-2026-69705, describing a critical security flaw in the Windows iSCSI service. The vulnerability allows an unauthorized attacker to execute code remotely without any form of authentication. According to the Microsoft Security Update Guide, the issue stems from an out-of-bounds write error within the iSCSI component.

This means an attacker can send specially crafted data to a targeted system and gain the ability to run code. The National Vulnerability Database confirms the severity rating of 9.8, classifying the threat as critical. This high score reflects the severity of the remote code execution capability. Security teams should treat this as a significant concern for any Windows infrastructure using iSCSI.

In plain English

The iSCSI protocol allows computers to access storage devices over a network as if they were locally attached. The Windows implementation of this protocol contains a specific error in how it handles certain data inputs. When the system processes malformed information, it writes data beyond the intended memory boundaries. This memory corruption can be manipulated by an attacker to run malicious programs on the affected machine. Because no login or password is required, anyone with network access to the service can attempt this exploit. The result is remote code execution, allowing the attacker to run their own code on the target system.

The background

The vulnerability is tracked as CVE-2026-69705 in official security records. Microsoft’s advisory highlights that the flaw exists in the core Windows operating system’s handling of iSCSI connections. The National Vulnerability Database lists the weakness under CWE-787, which covers out-of-bounds write errors. These types of memory corruption bugs are often severe because they allow attackers to bypass standard security controls. The lack of an authentication requirement makes this particularly dangerous for exposed systems. It does not matter if the attacker is inside or outside the local network, provided they can reach the service port.

What changes now

Organizations using Windows servers with iSCSI enabled must assess their exposure immediately. The critical severity rating indicates that the vulnerability is rated as critical by Microsoft and the NVD. Since the flaw allows remote code execution without credentials, any system with the service active and reachable is at risk. Administrators should verify which systems are running vulnerable versions of Windows and have iSCSI initialized. Network segmentation can help limit access to these services, but it does not fix the underlying code defect. The source material does not confirm if a patch is currently available.

What made it possible

Memory corruption vulnerabilities like this one often arise from inadequate input validation in system services. Attackers exploit these weaknesses by sending data that the software does not expect, causing it to write information into restricted memory areas. This technique serves the initial access stage of an intrusion, allowing remote compromise without user interaction. Teams usually mitigate such risks by ensuring all system components are updated promptly. Check whether network-facing services are strictly necessary and disable them if they are not required for business operations. Limiting exposure reduces the attack surface for these types of memory errors.

What to do and how to stay safe: Microsoft

• Identify all Windows systems running the iSCSI service and verify their current patch status.
• Restrict network access to iSCSI ports to only authorized management stations using firewall rules.
• Monitor network logs for unusual traffic patterns targeting iSCSI ports from unauthorized sources.
• Disable the iSCSI initiator service on any system that does not actively require network storage access.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability require an attacker to have a user account?

No, the advisory states that an unauthorized attacker can exploit the flaw without authentication.

What is the CVSS score for CVE-2026-69705?

The National Vulnerability Database assigns a CVSS score of 9.8, rating it as critical.

Is there a confirmed fix available yet?

No fix has been confirmed yet; the source material only describes the vulnerability and its severity.