CVE-2026-65791 – Windows iSCSI Target Service Remote Code Execution Vulnerability

CVE-2026-65791 is a critical heap-based buffer overflow in the Windows iSCSI Target Service. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The attack has low complexity and requires neither privileges nor user interaction.

CVSS Score: 9.8.

SEVERITY: Critical.

THREAT:
The vulnerability presents a significant remote code execution threat to affected Windows systems running the vulnerable iSCSI Target Service. An attacker can target the service over the network without authentication. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS:
This vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is listed as Unproven. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
CVE-2026-65791 is caused by a heap-based buffer overflow (CWE-122) in the Windows iSCSI Target Service. An unauthenticated attacker can send a specially crafted packet over the network to an affected service. Processing that packet can trigger the memory corruption condition and allow remote code execution on the target system. The CVSS metrics identify a network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope, with high confidentiality, integrity, and availability impacts.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable 32-bit/x64 variants. Exploitation can occur by sending a specially crafted network packet to the affected iSCSI Target Service without authentication.

BUSINESS IMPACT:
Successful exploitation could allow an unauthorized remote attacker to execute code on an affected system, creating serious risks to sensitive information, system integrity, and service availability. For organizations with reachable affected services, this could turn a network-facing vulnerability into a route for system compromise and operational disruption.

WORKAROUND:
No mitigations or workarounds are identified. An official fix is listed, so affected systems should receive the applicable security update.

URGENCY:
This is a Critical vulnerability with a CVSS base score of 9.8 and a low-complexity network attack path requiring no privileges or user interaction. Although exploitation is not reported and exploit maturity is Unproven, its remote code execution potential and high confidentiality, integrity, and availability impacts make prompt deployment important.