Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

CVE-2026-65791: Windows iSCSI Target Service Remote Code Execution

CVE-2026-65791 CVE-2026-65791
Summary

The Windows iSCSI Target Service is affected by a vulnerability that could allow an attacker to execute malicious code on a computer from another network location. This could potentially allow an attacker to take control of the computer or disrupt its operation. To protect against this vulnerability, consider applying the latest updates from Microsoft.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software
VendorProductAffected versions
microsoft windows 10 version 1607 < 10.0.14393.9418
microsoft windows 10 version 1809 < 10.0.17763.9115
microsoft windows server 2012 < 6.2.9200.26279
microsoft windows server 2012 (server core installation) < 6.2.9200.26279
microsoft windows server 2012 r2 < 6.3.9600.23337
microsoft windows server 2012 r2 (server core installation) < 6.3.9600.23337
microsoft windows server 2016 < 10.0.14393.9418
microsoft windows server 2016 (server core installation) < 10.0.14393.9418
microsoft windows server 2019 < 10.0.17763.9115
microsoft windows server 2019 (server core installation) < 10.0.17763.9115
microsoft windows server 2022 < 10.0.20348.5499
microsoft windows server 2025 < 10.0.26100.33296
microsoft windows server 2025 (server core installation) < 10.0.26100.33296
Original title
Windows iSCSI Target Service Remote Code Execution Vulnerability
Original description
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
mitre CVSS3.1 9.8
Vulnerability type
CWE-122 Heap-based Buffer Overflow
Published: 11 Aug 2026 · Updated: 11 Aug 2026 · First seen: 11 Aug 2026