CVE-2026-69839: Windows iSCSI Target Service DoS Vulnerability

CVE-2026-69839 is a denial of service vulnerability in Windows iSCSI Target Service caused by an uncaught exception. Authorized attackers can exploit this flaw over a network to disrupt service availability. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-69839 Overview

CVE-2026-69839 is a denial-of-service vulnerability in the Windows iSCSI Target Service. An authorized attacker with low privileges can send crafted network traffic that triggers an uncaught exception [CWE-248] in the service. The exception terminates the service process, disrupting iSCSI storage availability for connected initiators.

The flaw is network-reachable and requires no user interaction. Successful exploitation impacts availability of block storage exposed through the iSCSI Target role, which is commonly used for virtualization, backup, and clustered workloads.

Critical Impact
Loss of iSCSI storage availability can cascade into dependent VMs, databases, and clustered services that rely on the affected target for block storage.

Affected Products

Windows iSCSI Target Service (Microsoft)
Windows Server deployments running the iSCSI Target role
Refer to the Microsoft Update Guide CVE-2026-69839 for the authoritative product and build list

Discovery Timeline

2026-09-08 - CVE-2026-69839 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-69839

Vulnerability Analysis

The Windows iSCSI Target Service fails to handle a specific error condition during processing of network-supplied input. Instead of returning a controlled error, the service raises an uncaught exception [CWE-248] that propagates to the top of the call stack. The service host process terminates, taking active iSCSI target sessions with it.

Exploitation requires network access to the iSCSI Target Service and valid low-privilege credentials to establish an authenticated session. Once connected, an attacker sends the malformed request that reaches the vulnerable code path. Confidentiality and integrity of stored data are not directly affected, but block storage becomes unavailable to initiators until the service restarts.

Root Cause

The root cause is missing exception handling around a code path reachable through authenticated iSCSI protocol interactions. The service does not wrap the affected operation in structured exception handling, so an unexpected condition bubbles up and terminates the process. This maps to CWE-248: Uncaught Exception.

Attack Vector

The attack vector is network-based against the iSCSI Target Service listening port (TCP/3260 by default). The attacker authenticates using compromised or legitimate low-privilege credentials, then issues a crafted protocol sequence that triggers the exception. No user interaction is required, and the attack can be automated to repeatedly crash the service after each restart.

No public proof-of-concept code is available at the time of publication. See the Microsoft Update Guide CVE-2026-69839 for the vendor's technical description.

Detection Methods for CVE-2026-69839

Indicators of Compromise

Unexpected termination of the WinTarget service or the iSCSI Target service host process
Windows Service Control Manager events indicating repeated service crashes and restarts
Application or System event log entries recording an unhandled exception in the iSCSI Target Service
Sudden loss of iSCSI sessions reported by initiator hosts against a specific target

Detection Strategies

Alert on Service Control Manager Event ID 7031 or 7034 referencing the iSCSI Target Service
Correlate service crash events with authenticated iSCSI sessions from unexpected source IPs
Monitor for abnormal patterns of iSCSI login and logout activity preceding service failure

Monitoring Recommendations

Forward Windows Application, System, and Security event logs from iSCSI Target hosts to a central SIEM
Track availability metrics for iSCSI LUNs and alert on session drops that align with service restarts
Restrict and log network access to TCP/3260 and review connections from non-inventoried hosts

How to Mitigate CVE-2026-69839

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Update Guide CVE-2026-69839 for all affected Windows Server systems running the iSCSI Target role
Inventory hosts with the iSCSI Target Service enabled and prioritize those exposing the service beyond isolated storage networks
Rotate credentials for iSCSI CHAP users and any accounts capable of initiating authenticated sessions to the target

Patch Information

Microsoft has published guidance and updates for CVE-2026-69839. Consult the Microsoft Update Guide CVE-2026-69839 for the specific KB articles, affected builds, and superseded updates that apply to your environment. Deploy the updates through Windows Update, WSUS, or your configuration management platform, and reboot as required.

Workarounds

Restrict TCP/3260 access to trusted initiator subnets using host and network firewall rules
Isolate iSCSI traffic on a dedicated storage VLAN separated from general user networks
Enforce mutual CHAP authentication and remove unused iSCSI target accounts
Disable the iSCSI Target Service on hosts where the role is not required until patches are applied

bash

# Restrict inbound iSCSI to a trusted initiator subnet on Windows Server
New-NetFirewallRule -DisplayName "iSCSI Target - Trusted Initiators" `
  -Direction Inbound -Protocol TCP -LocalPort 3260 `
  -RemoteAddress 10.20.30.0/24 -Action Allow

New-NetFirewallRule -DisplayName "iSCSI Target - Block Other" `
  -Direction Inbound -Protocol TCP -LocalPort 3260 -Action Block