CVE-2026-73025: Windows iSCSI Auth Bypass Vulnerability

CVE-2026-73025 Overview

CVE-2026-73025 is a weak authentication vulnerability in the Windows Internet Small Computer Systems Interface (iSCSI) implementation. The flaw allows an unauthorized attacker to bypass a security feature over the network without user interaction. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

The weakness is tracked under [CWE-1390: Weak Authentication]. Because iSCSI exposes block-level storage to remote initiators, a successful bypass can grant an attacker access to storage volumes intended to be gated by authentication controls such as Challenge-Handshake Authentication Protocol (CHAP).

Critical Impact

An unauthenticated network attacker can bypass iSCSI authentication controls, potentially exposing enterprise storage targets and the data they contain.

Affected Products

• Microsoft Windows (iSCSI component)
• Windows Server iSCSI Target Server role
• Windows systems exposing iSCSI initiator or target services on the network

Discovery Timeline

• 2026-09-08 - CVE-2026-73025 published to the National Vulnerability Database (NVD)
• 2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-73025

Vulnerability Analysis

The vulnerability resides in the authentication layer of the Windows iSCSI stack. iSCSI transports SCSI commands over TCP/IP and typically relies on CHAP for initiator and target authentication. A weakness in how Windows validates or enforces these credentials permits an attacker to reach protected iSCSI functionality without valid authentication material.

The attack is remotely exploitable, requires no privileges, and needs no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the affected storage target. Attackers can potentially read, modify, or disrupt any logical unit number (LUN) exposed by the target.

Microsoft has not released public technical details beyond the advisory. Refer to the Microsoft Vulnerability Advisory CVE-2026-73025 for vendor guidance.

Root Cause

The root cause is classified under [CWE-1390: Weak Authentication]. The Windows iSCSI service does not sufficiently enforce authentication guarantees before granting access to protected operations. Weak authentication frequently stems from missing challenge validation, acceptance of trivial credentials, or fallthrough logic that permits unauthenticated sessions.

Attack Vector

The attack vector is network-based. An attacker with TCP reachability to the iSCSI service port (typically TCP/3260) can initiate a session and bypass the authentication check. No prior credentials, elevated privileges, or user interaction are required.

Because iSCSI is commonly deployed on internal storage networks, exposure often depends on network segmentation. Environments that expose iSCSI to broader corporate LANs, converged fabrics, or the internet face the highest risk.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability is not tied to a specific exploitation code sample. See the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-73025

Indicators of Compromise

• Unexpected iSCSI login attempts or successful sessions from unknown initiator IQNs (iSCSI Qualified Names).
• Connections to TCP port 3260 from source addresses outside the approved storage network segment.
• Anomalous read or write volume against iSCSI LUNs, especially outside normal maintenance windows.
• Windows Event Log entries from the MSiSCSI service showing authentication anomalies or repeated session establishment.

Detection Strategies

• Enable and centrally collect iSCSI target audit logs, then alert on logins that succeed without a matching CHAP credential validation event.
• Baseline legitimate initiator IQNs and source IP addresses, then flag deviations at the SIEM.
• Deploy network intrusion detection signatures for iSCSI PDU (Protocol Data Unit) login sequences from unauthorized subnets.

Monitoring Recommendations

• Continuously monitor TCP/3260 traffic flows and correlate against approved initiator inventories.
• Track Windows Event IDs from the iSCSI Target Server and initiator components for authentication failures and unusual session churn.
• Alert on new iSCSI target discovery scans, which often precede exploitation attempts.

How to Mitigate CVE-2026-73025

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-73025 to all Windows systems running iSCSI initiator or target roles.
• Inventory all systems with the iSCSI Target Server role or active iSCSI initiator sessions and prioritize internet-adjacent hosts.
• Restrict TCP/3260 access using host firewalls and network access control lists to only approved storage subnets.

Patch Information

Microsoft has published a security update through the Microsoft Update Guide. Consult the Microsoft Vulnerability Advisory CVE-2026-73025 for the specific KB article and affected build numbers applicable to each Windows release.

Workarounds

• Isolate iSCSI traffic on a dedicated, physically or logically segmented storage network with no route from user or internet-facing zones.
• Enforce mutual CHAP authentication on every iSCSI target and initiator pair, using strong secrets of at least 12 characters.
• Disable the iSCSI Target Server role on systems that do not require it, and stop the MSiSCSI service on hosts that do not consume iSCSI storage.
• Require IPsec for all iSCSI sessions to add a network-layer authentication and encryption boundary.

# Configuration example: restrict iSCSI target access on Windows Server
# Remove the iSCSI Target Server role if unused
Uninstall-WindowsFeature -Name FS-iSCSITarget-Server

# If the role is required, enforce CHAP and restrict initiator IQNs
Set-IscsiServerTarget -TargetName "StorageTarget01" -EnableChap $true
Set-IscsiServerTarget -TargetName "StorageTarget01" -InitiatorIds @("IQN:iqn.1991-05.com.microsoft:approved-host-01")

# Restrict inbound TCP/3260 to the approved storage subnet
New-NetFirewallRule -DisplayName "iSCSI-Restrict-3260" -Direction Inbound -Protocol TCP -LocalPort 3260 -RemoteAddress 10.20.30.0/24 -Action Allow
New-NetFirewallRule -DisplayName "iSCSI-Block-Other" -Direction Inbound -Protocol TCP -LocalPort 3260 -Action Block