CVE-2026-65791: Windows iSCSI Buffer Overflow Vulnerability

CVE-2026-65791 Overview

CVE-2026-65791 is a heap-based buffer overflow vulnerability in the Windows iSCSI Target Service. An unauthenticated remote attacker can exploit this flaw to execute arbitrary code over the network. The vulnerability is classified under [CWE-122] (Heap-based Buffer Overflow) and carries a CVSS 3.1 score of 9.8.

The iSCSI Target Service exposes storage over TCP/IP to remote initiators. Because the flaw requires no privileges and no user interaction, any reachable iSCSI target endpoint is at risk. Successful exploitation compromises confidentiality, integrity, and availability of the host.

Critical Impact
Unauthenticated attackers can achieve remote code execution on Windows systems running the iSCSI Target Service, potentially leading to full system compromise across storage infrastructure.

Affected Products

Windows iSCSI Target Service
Windows Server deployments with the iSCSI Target role enabled
Refer to the Microsoft Security Update CVE-2026-65791 for the authoritative list of affected builds

Discovery Timeline

2026-08-11 - CVE-2026-65791 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65791

Vulnerability Analysis

The vulnerability resides in the Windows iSCSI Target Service, which handles Internet Small Computer Systems Interface (iSCSI) protocol traffic for exposing block storage to remote initiators. A heap-based buffer overflow occurs when the service processes attacker-controlled input from a network packet without validating the size of the data written to a heap-allocated buffer.

An attacker who reaches the iSCSI service over TCP (typically port 3260) can send a crafted Protocol Data Unit (PDU) that triggers the overflow. Corrupting heap metadata or adjacent objects allows the attacker to hijack control flow and execute code in the context of the vulnerable service.

Because the iSCSI Target Service typically runs with elevated privileges, successful exploitation can lead to full system compromise. Storage servers often act as central assets, increasing the blast radius of a successful attack.

Root Cause

The root cause is inadequate bounds checking during the parsing of iSCSI protocol data received from remote clients. A length field, buffer copy, or PDU parsing routine writes attacker-controlled data past the boundaries of a heap allocation, corrupting adjacent heap structures.

Attack Vector

Exploitation occurs remotely over the network. The attacker requires no authentication, no privileges, and no user interaction. Any network-adjacent system with access to the iSCSI Target Service listener can deliver the malicious payload.

No verified public proof-of-concept code or exploit was available at the time of publication. For technical details, see the Microsoft Security Update CVE-2026-65791.

Detection Methods for CVE-2026-65791

Indicators of Compromise

Unexpected crashes, restarts, or memory faults in the WinTarget or iSCSITarget service processes
Anomalous inbound TCP connections to port 3260 from untrusted or external networks
Malformed iSCSI Protocol Data Units logged by network inspection tools
New child processes or unexpected outbound connections originating from the iSCSI Target Service

Detection Strategies

Monitor Windows Event Logs for service crashes and Windows Error Reporting entries tied to the iSCSI Target Service
Deploy network-layer inspection to identify oversized or malformed iSCSI PDUs targeting port 3260
Baseline expected iSCSI initiator IPs and alert on connections from unauthorized sources

Monitoring Recommendations

Enable process creation and command-line auditing on Windows Server hosts running the iSCSI Target role
Forward endpoint telemetry and network flow data to a SIEM for correlation of service crashes with inbound iSCSI traffic
Track any lateral movement or credential access activity following anomalous iSCSI service behavior

How to Mitigate CVE-2026-65791

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-65791 advisory as soon as possible
Inventory all Windows Servers with the iSCSI Target Server role enabled and prioritize patching internet-adjacent hosts
Restrict network access to TCP port 3260 to trusted initiator subnets using host and perimeter firewalls

Patch Information

Microsoft has released a security update addressing CVE-2026-65791. Administrators should consult the Microsoft Security Update CVE-2026-65791 page for the exact KB article, build numbers, and download links matching each supported Windows Server release.

Workarounds

Disable the iSCSI Target Service on hosts that do not require it using Stop-Service WinTarget and Set-Service WinTarget -StartupType Disabled
Segment storage networks and enforce firewall rules that permit iSCSI traffic only from known initiator IP addresses
Require IPsec authentication for iSCSI connections to reduce exposure to unauthenticated attackers

bash

# Disable the Windows iSCSI Target Service where not required (PowerShell)
Stop-Service -Name WinTarget -Force
Set-Service -Name WinTarget -StartupType Disabled

# Restrict inbound iSCSI traffic to trusted initiator subnets
New-NetFirewallRule -DisplayName "Block-iSCSI-Untrusted" `
    -Direction Inbound -Protocol TCP -LocalPort 3260 `
    -RemoteAddress Any -Action Block