CVE-2026-70013: Windows iSCSI Use After Free Vulnerability

CVE-2026-70013 Overview

CVE-2026-70013 is a use-after-free vulnerability in the Windows Internet Small Computer Systems Interface (iSCSI) component. The flaw allows an unauthenticated remote attacker to execute arbitrary code over the network by triggering reuse of freed memory in the iSCSI service. Microsoft published the advisory on October 13, 2026.

The vulnerability is tracked under CWE-416: Use After Free. Successful exploitation can compromise confidentiality, integrity, and availability of affected Windows hosts running the iSCSI service. The attack complexity is high, which reduces trivial mass-exploitation risk, but a working exploit would grant remote code execution without user interaction.

Critical Impact
Unauthenticated remote code execution against Windows systems exposing the iSCSI service to a network reachable by an attacker.

Affected Products

Microsoft Windows (iSCSI component) — refer to the Microsoft Security Update Guide for the complete list of affected builds.

Discovery Timeline

2026-10-13 - CVE-2026-70013 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-70013

Vulnerability Analysis

The vulnerability resides in the Windows iSCSI implementation, which handles block-level storage traffic over TCP/IP. A use-after-free condition occurs when the iSCSI service references a memory object after it has been released. Attackers who control the timing and content of subsequent allocations can place attacker-chosen data in the freed region. When the dangling pointer is dereferenced, execution flow can be redirected to attacker-controlled memory.

Because iSCSI listens on the network, an unauthenticated attacker able to reach the iSCSI endpoint can send crafted protocol messages that drive the vulnerable code path. The advisory indicates no privileges and no user interaction are required. High attack complexity suggests that reliable exploitation depends on winning a race or shaping the heap, which raises the bar for weaponization but does not eliminate the risk.

Root Cause

The root cause is a lifetime-management defect classified as [CWE-416]. The iSCSI component frees a kernel or service-side object while retaining a reference that is later used. Memory reallocation between the free and the subsequent use enables controlled corruption of the freed structure.

Attack Vector

The attack vector is network-based. An attacker sends crafted iSCSI protocol traffic to a host exposing the service, triggering the free-then-reuse sequence. No credentials and no interactive user action are required. Microsoft has not reported in-the-wild exploitation, and no public proof-of-concept is referenced in the advisory.

See the Microsoft Security Update Guide for CVE-2026-70013 for component and build specifics.

Detection Methods for CVE-2026-70013

Indicators of Compromise

Unexpected inbound TCP connections to the iSCSI port (default 3260/tcp) from untrusted network segments.
Crashes, bugchecks, or service restarts referencing the iSCSI driver or Microsoft-Windows-iSCSI event sources.
Unexplained child processes or memory regions in iSCSI-related service contexts following inbound traffic bursts.

Detection Strategies

Baseline which hosts legitimately expose iSCSI and alert on new or unauthorized listeners on 3260/tcp.
Correlate kernel memory faults and service restarts with recent inbound iSCSI session activity.
Hunt for anomalous iSCSI login PDUs with malformed or oversized text keys that deviate from initiator norms.

Monitoring Recommendations

Forward Windows System, Application, and Microsoft-Windows-iSCSI operational logs to centralized analytics.
Monitor east-west traffic to storage subnets for iSCSI sessions originating outside expected initiator ranges.
Track patch deployment status against the Microsoft update identifier for CVE-2026-70013 across the fleet.

How to Mitigate CVE-2026-70013

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-70013 to all affected Windows systems.
Inventory hosts with the iSCSI Target or Initiator service enabled and prioritize patching those exposed to untrusted networks.
Restrict 3260/tcp to known initiator IP ranges using host and perimeter firewalls.

Patch Information

Microsoft published the fix on October 13, 2026. Administrators should install the corresponding cumulative update identified in the Microsoft Security Update Guide and reboot the affected systems to activate kernel-level fixes.

Workarounds

Disable the iSCSI Target Server role on hosts that do not require it until patching is complete.
Segment storage networks so iSCSI endpoints are only reachable from dedicated initiator VLANs.
Enforce IPsec authentication for iSCSI sessions to block unauthenticated attackers from reaching the vulnerable code path.