NVD rates Windows iSCSI flaw CVE-2026-69705 as critical 9.8 for unauth RCE

Microsoft has disclosed a critical security vulnerability in its Windows iSCSI implementation that allows unauthorized attackers to execute code over a network. The National Vulnerability Database assigned a maximum severity score of 9.8 to the flaw, identified as CVE-2026-69705. This rating reflects the severity of the issue as determined by the NVD.

The vulnerability involves an out-of-bounds write in Windows iSCSI. According to the Microsoft Security Update Guide, this defect allows an unauthorized attacker to execute code over a network. The National Vulnerability Database categorizes the underlying weakness as CWE-787. This classification refers to out-of-bounds writes as defined by the Common Weakness Enumeration.

Context and Background

The issue affects the Internet Small Computer Systems Interface (iSCSI) functionality in Windows operating systems. iSCSI enables the transport of SCSI commands over IP networks. Microsoft’s official advisory describes the flaw simply as an out-of-bounds write that allows code execution. The National Vulnerability Database mirrors this description, confirming the technical nature of the defect.

Security researchers and analysts rely on the CVSS score to prioritize patching efforts. A score of 9.8 indicates that the vulnerability is rated critical. The absence of required authentication is noted in the Microsoft description. Organizations must treat this finding with attention due to the critical rating assigned by the National Vulnerability Database.

Who Is Affected

The vulnerability impacts systems running Windows iSCSI. Any environment utilizing iSCSI for storage connectivity is potentially at risk. The Microsoft Security Update Guide does not specify particular Windows versions in the provided summary. Administrators should assume that any Windows system with iSCSI enabled could be vulnerable.

Network exposure is a key factor in determining actual risk. Systems that allow iSCSI traffic from untrusted sources face the highest threat level. The critical rating suggests that the flaw is severe. The source material states that an unauthorized attacker can execute code over a network, implying remote exploitability.

What should you do?

Organizations should immediately audit their Windows environments for active iSCSI services. Disable the iSCSI initiator or target service on any system that does not strictly require it for business operations. Network segmentation can limit exposure by preventing unauthorized access to iSCSI ports. Monitor logs for unusual activity related to iSCSI connections, as this may indicate an attempted exploit.

What to do and how to stay safe: Microsoft

• Disable the Windows iSCSI service on systems where it is not essential for daily operations.
• Implement strict network firewall rules to block inbound iSCSI traffic from untrusted sources.
• Monitor system logs and network traffic for anomalous iSCSI connection attempts or data transfers.
• Prepare to apply vendor updates once Microsoft releases a confirmed patch for CVE-2026-69705.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-69705?

The National Vulnerability Database rates CVE-2026-69705 as critical with a CVSS score of 9.8.

What type of vulnerability is CVE-2026-69705?

It is an out-of-bounds write vulnerability in Windows iSCSI that allows remote code execution.

Does the vulnerability require authentication to exploit?

No, Microsoft states that an unauthorized attacker can execute code over a network without prior authentication.