CVE-2026-69628: Windows iSCSI Buffer Overflow Vulnerability

CVE-2026-69628 Overview

CVE-2026-69628 is a heap-based buffer overflow [CWE-122] in the Windows Internet Small Computer Systems Interface (iSCSI) implementation. An authorized attacker can exploit the flaw over a network to execute arbitrary code on the target system. Microsoft published the advisory on 2026-09-08 with a CVSS 3.1 base score of 8.8.

Successful exploitation compromises confidentiality, integrity, and availability of the affected host. The attack requires low privileges and no user interaction, making it well suited for lateral movement in storage-area networks that rely on iSCSI initiators or targets.

Critical Impact
Authenticated network attackers can achieve remote code execution against Windows iSCSI components, enabling full host compromise and lateral movement across storage fabrics.

Affected Products

Microsoft Windows (iSCSI component) — refer to the Microsoft Security Response Center advisory for the complete list of affected builds
Windows Server editions exposing iSCSI initiator or target services
Windows client editions with the iSCSI initiator feature enabled

Discovery Timeline

2026-09-08 - CVE-2026-69628 published to the National Vulnerability Database
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-69628

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the Windows iSCSI subsystem. iSCSI encapsulates SCSI commands within TCP/IP, allowing block-level storage traffic to traverse standard networks. A malformed protocol data unit or oversized field processed by the vulnerable code path writes beyond an allocated heap buffer.

An attacker with valid credentials on the network can send crafted iSCSI traffic to a listening endpoint. Because the flaw resides in server-side parsing logic that runs at elevated privilege, corrupting adjacent heap structures can redirect execution flow. The scope remains unchanged, meaning the attacker gains code execution within the same security context as the vulnerable service.

See the Microsoft CVE-2026-69628 Advisory for authoritative technical details.

Root Cause

The root cause is insufficient bounds validation on attacker-controlled length or offset fields before copying data into a fixed-size heap allocation. When the input exceeds the destination buffer, adjacent heap metadata or object pointers are overwritten, producing a controllable memory corruption primitive.

Attack Vector

The attack vector is network-based and requires authentication. An adversary who can reach the iSCSI service and holds valid credentials can transmit a specially crafted iSCSI request. No user interaction is required, and exploitation complexity is low, according to the published CVSS vector. The EPSS probability at publication is approximately 0.91%.

Refer to the Microsoft CVE-2026-69628 Advisory for exploitation prerequisites and patch mapping.

Detection Methods for CVE-2026-69628

Indicators of Compromise

Unexpected crashes or restarts of the Microsoft iSCSI Initiator Service (MSiSCSI) or associated storage services
Anomalous inbound connections to TCP port 3260 from hosts that do not normally initiate iSCSI sessions
Malformed or oversized iSCSI Protocol Data Units (PDUs) captured on the wire between initiators and targets
New processes spawned by iSCSI-related services following authenticated network sessions

Detection Strategies

Baseline legitimate iSCSI initiator and target endpoints, then alert on new peers negotiating sessions
Deploy protocol-aware network intrusion detection signatures that validate iSCSI PDU length fields
Correlate Windows event logs for iSCSI service faults with authentication events from the same source
Monitor endpoint telemetry for heap corruption crash signatures and unexpected child processes of iSCSI service binaries

Monitoring Recommendations

Enable Windows Event Log collection for the Microsoft-Windows-iSCSI provider and forward to a central SIEM
Capture NetFlow or full packet data on segments carrying storage traffic to enable retrospective hunting
Alert on Windows Error Reporting entries referencing iSCSI service modules and correlate with authentication activity

How to Mitigate CVE-2026-69628

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-69628 Advisory to all affected Windows systems
Inventory hosts running the iSCSI Initiator Service or acting as iSCSI targets and prioritize patching
Restrict inbound access to TCP port 3260 to trusted storage-network segments only
Rotate credentials used for iSCSI CHAP authentication after patching

Patch Information

Microsoft has released a security update addressing CVE-2026-69628. Consult the Microsoft Security Response Center advisory for the specific KB article numbers and affected Windows builds. Apply the update through Windows Update, Windows Server Update Services, or your enterprise patch management platform.

Workarounds

Disable the Microsoft iSCSI Initiator Service on hosts that do not require iSCSI storage connectivity
Isolate iSCSI traffic on a dedicated VLAN and enforce host-based firewall rules limiting port 3260 to known peers
Require IPsec authentication and encryption for all iSCSI sessions to reduce the attacker population

bash

# Disable the iSCSI Initiator Service on hosts that do not require it
Stop-Service -Name MSiSCSI -Force
Set-Service -Name MSiSCSI -StartupType Disabled

# Restrict inbound iSCSI traffic to a trusted storage subnet
New-NetFirewallRule -DisplayName "Block iSCSI Inbound" \
  -Direction Inbound -Protocol TCP -LocalPort 3260 \
  -RemoteAddress Any -Action Block