Windows iSCSI component suffers heap overflow allowing network code execution in CVE-2026-69634

Microsoft has published an advisory detailing a critical security vulnerability in the Windows iSCSI subsystem. The flaw, tracked as CVE-2026-69634, allows an unauthorized attacker to execute arbitrary code over a network. The National Vulnerability Database assigns the issue a CVSS score of 9.8, classifying it as Critical.

The vulnerability stems from a heap-based buffer overflow within the iSCSI functionality. According to the Microsoft Security Update Guide, this weakness enables remote code execution by an attacker who does not need local access. The National Vulnerability Database lists the underlying weakness as CWE-122, which pertains to buffer copy without checking size of input.

Technical context and severity rating

The National Vulnerability Database record for CVE-2026-69634 confirms the high severity rating. A CVSS score of 9.8 indicates that the flaw is extremely serious and typically requires immediate attention from security teams. The description in both the Microsoft advisory and the NVD record is identical, stating that the heap-based buffer overflow allows unauthorized network-based code execution.

Microsoft’s advisory does not specify a particular Windows version or build number that is affected. The description applies broadly to the Windows iSCSI component. Security professionals should note that iSCSI is commonly used to transport SCSI commands over IP networks, often for storage area networks. The potential for remote exploitation makes this a significant risk for systems exposing iSCSI services.

Affected systems and exposure

The source material identifies Windows iSCSI as the affected component. No specific operating system versions are listed in the provided advisory or NVD record. Organizations using Windows servers or workstations that enable iSCSI initiator services are potentially exposed. The ability for an unauthorized attacker to execute code over a network suggests that any system reachable via the network could be targeted if the service is active.

Microsoft has not confirmed the availability of a patch, fix, or security update for this vulnerability in the provided materials. The advisory serves as a disclosure of the risk. Without a confirmed remediation, systems remain vulnerable to exploitation. Security teams should monitor official channels for updates regarding mitigation or patches.

What should you do?

Security professionals should verify which systems within their environment have the iSCSI initiator service enabled. If iSCSI is not required for specific workloads, disabling the service can reduce the attack surface. Organizations should review network segmentation policies to ensure that iSCSI traffic is isolated from general user networks. Monitoring for unusual outbound connections or process creation on systems running iSCSI may help detect exploitation attempts.

What to do and how to stay safe: Microsoft

• Audit your inventory to identify Windows systems with the iSCSI initiator service enabled
• Disable the iSCSI service on any system that does not strictly require iSCSI connectivity
• Implement network segmentation to restrict access to iSCSI ports to authorized management networks only
• Monitor system logs for anomalous process execution or unauthorized network activity on affected hosts

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-69634?

The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.8.

Is there a patch available for this vulnerability?

No, the source material does not confirm that a patch, fix, or update has been released yet.

How is the vulnerability exploited?

It is a heap-based buffer overflow that allows an unauthorized attacker to execute code over a network.