CVE-2026-65679: Windows iSCSI Buffer Overflow Vulnerability

CVE-2026-65679 Overview

CVE-2026-65679 is a heap-based buffer overflow vulnerability [CWE-122] in the Windows iSCSI Target Service. The flaw allows an unauthenticated remote attacker to execute arbitrary code over a network. Exploitation requires no user interaction and no prior authentication, though attack complexity is high. Microsoft published the advisory on 2026-08-11 and last updated it on 2026-08-12.

The iSCSI Target Service exposes storage over TCP/IP, meaning the vulnerable code path is reachable from any host that can establish an iSCSI session with the target. Successful exploitation compromises confidentiality, integrity, and availability of the affected Windows system.

Critical Impact
Unauthenticated remote code execution in a Windows storage service reachable over the network. Successful exploitation grants attackers control of the iSCSI target host.

Affected Products

Windows iSCSI Target Service (specific Windows Server versions listed in the Microsoft advisory)
Refer to the Microsoft Security Update Guide for the complete list of affected builds
Systems with the iSCSI Target Server role installed and network-accessible

Discovery Timeline

2026-08-11 - CVE-2026-65679 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65679

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the Windows iSCSI Target Service. The service listens on TCP port 3260 by default and processes iSCSI Protocol Data Units (PDUs) from initiators before authentication completes. A crafted PDU triggers an out-of-bounds write on a heap allocation, corrupting adjacent heap metadata or object pointers.

Heap-based overflows in kernel-adjacent or service-level components typically enable attackers to overwrite function pointers, virtual table entries, or object headers. This grants control over execution flow when the corrupted structures are subsequently referenced. Because the iSCSI Target Service runs with SYSTEM privileges on Windows Server, successful exploitation yields high-privileged code execution.

The EPSS score of 0.557% suggests moderate exploitation likelihood in the near term. Attack complexity is high, which reflects the need to bypass modern Windows heap mitigations such as Low-Fragmentation Heap randomization, Control Flow Guard, and Address Space Layout Randomization.

Root Cause

The root cause is improper validation of length or offset fields within an iSCSI PDU before copying attacker-controlled data into a fixed-size heap buffer. Microsoft has not published field-level technical details. Refer to the Microsoft advisory for authoritative information.

Attack Vector

An attacker sends a malicious iSCSI request to a reachable Windows host running the iSCSI Target Service. No credentials are required. The vulnerable code path executes during PDU parsing, before initiator authentication. Systems exposing TCP port 3260 to untrusted networks are directly reachable; internal-only deployments require the attacker to gain a network foothold first.

No public proof-of-concept exploit is available at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-65679

Indicators of Compromise

Unexpected crashes or restarts of the WinTarget service or associated iscsiexe.exe process
Anomalous inbound TCP connections to port 3260 from untrusted sources or geographies
Malformed iSCSI PDUs in packet captures, particularly with oversized length fields
New child processes spawned by the iSCSI Target Service, such as cmd.exe or powershell.exe

Detection Strategies

Monitor Windows Event Logs for service crashes and Windows Error Reporting entries referencing iSCSI Target Service binaries
Inspect network traffic to TCP 3260 for PDU length fields that exceed protocol expectations
Baseline the expected initiator IP ranges and alert on new sources establishing iSCSI sessions

Monitoring Recommendations

Enable process creation auditing (Event ID 4688) and flag child processes of the iSCSI Target Service
Collect endpoint telemetry for memory-corruption indicators such as SYSTEM-level process crashes followed by outbound network connections
Forward logs to a SIEM and correlate iSCSI service anomalies with authentication and lateral movement events

How to Mitigate CVE-2026-65679

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all affected Windows Server systems
Inventory hosts running the iSCSI Target Server role and prioritize internet-exposed or DMZ systems
Restrict TCP port 3260 at the network perimeter and internal segmentation boundaries to authorized initiators only

Patch Information

Microsoft released a security update addressing CVE-2026-65679. Administrators should install the update through Windows Update, WSUS, or the Microsoft Update Catalog. Consult the Microsoft Security Update Guide for KB numbers and build-specific packages.

Workarounds

Disable the iSCSI Target Server role on systems that do not require it using Uninstall-WindowsFeature FS-iSCSITarget-Server
Enforce IPsec or firewall rules to permit iSCSI traffic only from known initiator addresses
Isolate storage networks from general-purpose corporate and internet-facing networks

bash

# Verify and disable the iSCSI Target Server role on unaffected-required hosts
Get-WindowsFeature -Name FS-iSCSITarget-Server
Uninstall-WindowsFeature -Name FS-iSCSITarget-Server -Restart

# Restrict inbound iSCSI traffic to authorized initiators
New-NetFirewallRule -DisplayName "Block-iSCSI-Untrusted" `
  -Direction Inbound -Protocol TCP -LocalPort 3260 `
  -RemoteAddress Any -Action Block