CVE-2026-65681: Windows iSCSI Target Service DoS Flaw

CVE-2026-65681 Overview

CVE-2026-65681 is a null pointer dereference vulnerability in the Windows iSCSI Target Service. An unauthenticated remote attacker can trigger the flaw over the network to cause a denial of service. The vulnerability is tracked under CWE-476: NULL Pointer Dereference and requires no user interaction or privileges.

Microsoft published the advisory in its Security Update Guide. The flaw affects availability only; confidentiality and integrity are not impacted.

Critical Impact
Remote, unauthenticated attackers can crash the Windows iSCSI Target Service, disrupting storage availability for dependent workloads and clients.

Affected Products

Microsoft Windows Server (iSCSI Target Service role)
Windows systems running the iSCSI Target Service
See the Microsoft Security Update Guide for the full list of affected builds

Discovery Timeline

2026-08-11 - CVE-2026-65681 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-65681

Vulnerability Analysis

The Windows iSCSI Target Service exposes storage over TCP port 3260 using the Internet Small Computer Systems Interface (iSCSI) protocol. The service contains a null pointer dereference reachable by an unauthenticated network client. When the vulnerable code path processes a malformed or unexpected iSCSI protocol data unit (PDU), it operates on a pointer that has not been initialized or validated.

Dereferencing the null pointer causes the service process to crash. Any initiators relying on the target lose access to their exported logical units, disrupting backup, virtualization, and cluster workloads that depend on iSCSI-backed storage.

The attack requires only network reachability to the iSCSI listener. No credentials, CHAP authentication, or user interaction are required to reach the vulnerable code path.

Root Cause

The root cause is missing validation of a pointer before dereference within the iSCSI Target Service request handling logic. Under specific input conditions, a structure member or allocation result remains null when the service attempts to read from or write to it, triggering an access violation and terminating the service.

Attack Vector

An attacker sends crafted iSCSI protocol traffic to the target service listener. The malformed PDU forces the vulnerable code path, dereferences the null pointer, and terminates the service. Refer to the Microsoft Security Update Guide for authoritative technical details, as no public proof-of-concept is available at this time.

Detection Methods for CVE-2026-65681

Indicators of Compromise

Unexpected termination or repeated restarts of the WinTarget service or related iSCSI Target processes
Windows Application/System event log entries showing access violation (0xC0000005) faults in iSCSI Target binaries
Loss of iSCSI initiator connectivity coinciding with inbound traffic to TCP port 3260 from untrusted sources

Detection Strategies

Monitor Windows Service Control Manager events (Event IDs 7031, 7034) for iSCSI Target Service crashes
Inspect network flows for unsolicited connections to TCP 3260 originating outside the storage management network
Correlate Windows Error Reporting (WER) crash dumps referencing iSCSI Target modules with concurrent network activity

Monitoring Recommendations

Enable centralized logging of Windows service state changes and forward to a SIEM for alerting
Baseline iSCSI initiator IP addresses and alert on new or external sources connecting to the target
Track service uptime metrics for Windows iSCSI Target hosts and alert on abnormal restart frequency

How to Mitigate CVE-2026-65681

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide to all systems running the iSCSI Target Service
Restrict TCP port 3260 access to trusted storage network segments using host and network firewalls
Inventory Windows Servers with the iSCSI Target Service role enabled and prioritize patching internet-exposed or DMZ-adjacent hosts

Patch Information

Microsoft has published the fix in its monthly security update cycle. Consult the Microsoft Security Update Guide entry for CVE-2026-65681 for the specific KB article and build numbers applicable to each affected Windows Server release.

Workarounds

Disable the iSCSI Target Service on hosts that do not require it using Set-Service -Name WinTarget -StartupType Disabled followed by Stop-Service WinTarget
Use IPsec or network segmentation to limit iSCSI traffic to authorized initiators only
Place iSCSI target hosts on isolated storage VLANs with no route from user or internet-facing networks

bash

# Configuration example: restrict iSCSI target access with Windows Firewall
New-NetFirewallRule -DisplayName "Block Untrusted iSCSI" -Direction Inbound -Protocol TCP -LocalPort 3260 -Action Block -RemoteAddress Any
New-NetFirewallRule -DisplayName "Allow Trusted iSCSI Initiators" -Direction Inbound -Protocol TCP -LocalPort 3260 -Action Allow -RemoteAddress 10.10.20.0/24