CVE-2026-65796: Windows iSCSI Target Service DoS Flaw

CVE-2026-65796 Overview

CVE-2026-65796 is a heap-based buffer overflow vulnerability in the Windows iSCSI Target Service. An unauthenticated remote attacker can send crafted network traffic to the iSCSI Target Service and trigger memory corruption on the heap. Successful exploitation causes a denial of service condition on the affected host.

The issue is tracked under CWE-122: Heap-based Buffer Overflow. Microsoft published the advisory in the Microsoft Security Update Guide. Exploitation requires no privileges and no user interaction, but the attack complexity is high. There is no confidentiality or integrity impact, only availability impact.

Critical Impact
An unauthenticated attacker with network access to the Windows iSCSI Target Service can crash the service and disrupt storage availability for dependent workloads.

Affected Products

Windows iSCSI Target Service (specific Windows Server versions per Microsoft advisory)
Refer to the Microsoft Security Update Guide entry for CVE-2026-65796 for the authoritative product and build list

Discovery Timeline

2026-08-11 - CVE-2026-65796 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-65796

Vulnerability Analysis

The vulnerability resides in the Windows iSCSI Target Service, which implements the server side of the Internet Small Computer Systems Interface (iSCSI) protocol. The service exposes storage LUNs over TCP, typically on port 3260, to remote initiators. A heap-based buffer overflow in the parsing of attacker-controlled iSCSI Protocol Data Units (PDUs) corrupts heap memory in the service process.

Because the flaw affects only availability, exploitation results in a service crash rather than code execution. The EPSS score is 0.645% with a percentile of 47.7, indicating a low but non-trivial predicted exploitation likelihood over the next 30 days. High attack complexity reflects the specific conditions required to reliably corrupt the heap and terminate the service.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122] in the iSCSI Target Service. The service allocates a heap buffer whose size does not accommodate the length of attacker-supplied data during PDU processing. When the service copies untrusted input past the allocated boundary, adjacent heap metadata or objects are overwritten, causing the process to terminate.

Attack Vector

The attack vector is network-based. An attacker sends malformed iSCSI PDUs to a reachable iSCSI Target Service endpoint. No authentication and no user interaction are required. Because iSCSI is typically deployed on internal storage networks, exposure depends on network segmentation between initiators, targets, and untrusted hosts.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2026-65796

Indicators of Compromise

Unexpected termination or repeated restarts of the WinTarget iSCSI Target Service process
Windows Service Control Manager events indicating iSCSI Target Service crashes or recovery actions
Application crash entries in the Windows Event Log referencing the iSCSI Target Service binary
Anomalous inbound TCP traffic to port 3260 from hosts that are not authorized iSCSI initiators

Detection Strategies

Monitor Windows Event Log channels System and Application for Service Control Manager events 7031 and 7034 tied to the iSCSI Target Service
Baseline expected iSCSI initiator IP addresses and alert on connections from unlisted sources
Inspect network flow data for malformed or truncated iSCSI PDUs on TCP/3260

Monitoring Recommendations

Forward Windows event logs and process telemetry from iSCSI target hosts to a centralized SIEM for correlation
Track service uptime and crash counters for the iSCSI Target Service as a health signal
Alert on repeated crash-restart cycles that indicate active exploitation attempts

How to Mitigate CVE-2026-65796

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-65796 to all Windows Server systems running the iSCSI Target Service
Inventory hosts with the WinTarget service enabled and prioritize patching of internet-exposed or broadly reachable targets
Restrict TCP/3260 access to authorized initiator IP ranges using host and network firewalls

Patch Information

Microsoft has released updates addressing CVE-2026-65796 through the standard Windows Update channels. Consult the Microsoft Security Update Guide for the specific KB article, affected build numbers, and cumulative update requirements for each supported Windows Server release.

Workarounds

Disable the iSCSI Target Service on hosts that do not require it using Stop-Service -Name WinTarget and Set-Service -Name WinTarget -StartupType Disabled
Enforce network segmentation so only trusted initiators can reach TCP/3260 on target hosts
Require CHAP authentication on iSCSI targets to reduce exposure from unauthorized senders where operationally feasible

bash

# Restrict inbound iSCSI target traffic to authorized initiators (PowerShell)
New-NetFirewallRule -DisplayName "Allow iSCSI Target from Initiators" `
  -Direction Inbound -Protocol TCP -LocalPort 3260 `
  -RemoteAddress 10.0.10.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block iSCSI Target from Untrusted" `
  -Direction Inbound -Protocol TCP -LocalPort 3260 `
  -Action Block