CVE-2026-68898: Windows iSCSI DOS Vulnerability

CVE-2026-68898 Overview

CVE-2026-68898 is an out-of-bounds read vulnerability [CWE-125] in the Windows Internet Small Computer Systems Interface (iSCSI) component. An unauthenticated attacker can send crafted network traffic to trigger the flaw and cause a denial of service on the affected host. The issue affects the iSCSI service that Windows systems use to access remote storage over TCP/IP networks.

Microsoft assigned this CVE and published an advisory through the Microsoft Security Response Center. Exploitation requires user interaction and yields no impact on confidentiality or integrity, but system availability can be fully disrupted.

Critical Impact
Successful exploitation causes Windows iSCSI services to terminate or hang, disrupting access to iSCSI-attached storage and any dependent workloads.

Affected Products

Microsoft Windows (iSCSI component) — refer to the Microsoft advisory for the authoritative list of affected builds
Windows Server deployments using the iSCSI Initiator or iSCSI Target Server role
Windows client editions with the iSCSI Initiator service enabled

Discovery Timeline

2026-09-08 - CVE-2026-68898 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-68898

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the Windows iSCSI component. The iSCSI stack processes network packets that contain length and offset fields describing Protocol Data Units (PDUs). When the code reads memory based on attacker-controlled fields without validating boundaries, it accesses memory outside the intended buffer.

Because the read occurs in a system service that handles storage traffic, the fault typically crashes the service or the kernel path servicing the request. The CVSS vector indicates the attack is network-reachable, requires no privileges, but does require user interaction. There is no confidentiality or integrity impact, only availability loss.

The EPSS score of 0.618% suggests low near-term exploitation probability. No public proof-of-concept, exploit code, or in-the-wild activity has been reported. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or insufficient bounds checking when the iSCSI component parses fields inside an inbound PDU. Attacker-supplied length or offset values guide a read past the end of an allocated buffer. This class of defect is tracked as [CWE-125], out-of-bounds read.

Attack Vector

The attack vector is network-based. An attacker sends a malformed iSCSI message toward a Windows host that processes iSCSI traffic. User interaction is required, which suggests the vulnerable code path is reached through an action such as connecting to an attacker-controlled iSCSI target or accepting a session with crafted parameters. Successful exploitation halts iSCSI I/O and can render dependent volumes inaccessible.

No verified exploitation code is public. See the Microsoft CVE-2026-68898 Advisory for authoritative technical details.

Detection Methods for CVE-2026-68898

Indicators of Compromise

Unexpected termination or repeated restarts of the Microsoft iSCSI Initiator Service (MSiSCSI) or iSCSI Target Server service (WinTarget)
Windows Event Log entries reporting iSCSI session disconnections, target unreachable errors, or storage stack faults
Bugchecks or Windows Error Reporting events referencing iscsiprt.sys or related iSCSI kernel components

Detection Strategies

Monitor for anomalous inbound TCP traffic to iSCSI port 3260 from untrusted networks or unexpected initiators
Correlate iSCSI service crashes with concurrent inbound sessions from unusual source addresses
Alert on repeated failed iSCSI logins or malformed PDU errors observed in storage stack telemetry

Monitoring Recommendations

Ingest Windows System and Application event logs into a centralized platform and build alerts for iSCSI service failures
Enable network telemetry on segments carrying iSCSI traffic and baseline expected initiator-target pairs
Track patch compliance for Windows storage components across servers and clients using iSCSI

How to Mitigate CVE-2026-68898

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-68898 Advisory on all affected hosts
Inventory systems running the iSCSI Initiator or iSCSI Target Server role and prioritize patching for internet-exposed or DMZ hosts
Restrict iSCSI traffic (TCP 3260) to trusted storage network segments using host and network firewalls

Patch Information

Microsoft has published a security update through the standard Update Guide. Administrators should consult the Microsoft CVE-2026-68898 Advisory for the current list of affected products, KB article numbers, and per-build fix availability. Deploy the update through Windows Update, WSUS, Microsoft Configuration Manager, or Intune according to standard change control.

Workarounds

Disable the iSCSI Initiator Service (MSiSCSI) on systems that do not use iSCSI-attached storage
Isolate iSCSI networks on dedicated VLANs and block TCP port 3260 at perimeter and internal segmentation firewalls
Enforce mutual CHAP authentication and IPsec for iSCSI sessions to limit exposure to unauthorized initiators and targets

bash

# Disable the iSCSI Initiator service on hosts that do not require it
Set-Service -Name MSiSCSI -StartupType Disabled
Stop-Service -Name MSiSCSI -Force

# Block inbound iSCSI traffic at the host firewall
New-NetFirewallRule -DisplayName "Block Inbound iSCSI" \
  -Direction Inbound -Protocol TCP -LocalPort 3260 -Action Block