CVE-2026-65791

Windows iSCSI Target Service Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 60th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile60th1.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Identify whether you run the Windows iSCSI Target Service (iSCSI Target role) on Windows 10/Server systems.
Check your OS version/build against the fixed versions listed by Microsoft for CVE-2026-65791.
Install the Microsoft security update for CVE-2026-65791 on affected systems as soon as possible.
If you can’t patch immediately, disable the iSCSI Target role/service and ensure the iSCSI Target endpoints are not reachable from untrusted networks.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-65791 is a Windows iSCSI Target Service flaw that lets a remote attacker run code on vulnerable systems, so a typical business should treat it as urgent and patch if you run the iSCSI Target role.

CVE-2026-65791 is a Windows iSCSI Target Service remote code execution vulnerability (CWE-122) caused by a heap-based buffer overflow, enabling an unauthorized attacker to execute code over the network against affected Windows 10/Server versions that are vulnerable and reachable.

If you're affected

Full system takeover
Data theft or ransomware
Service disruption
Credential compromise risk

What is it

iSCSI is a Windows feature used to share storage over a network. This vulnerability is like a “crash-and-break” bug in that service: if someone can reach it, they may be able to trick it into running their code on your server or workstation.

Who is affected

This matters to you if you use Windows iSCSI Target Service (the iSCSI Target role) on Windows 10 or Windows Server 2012/2012 R2/2016/2019/2022/2025 systems. It’s most relevant when the iSCSI target service is reachable from the network by someone you don’t fully trust. The risk is there only if the vulnerable service is reachable over the network (remote reachability), not just because the OS is installed.

How urgent is it

This is urgent because it’s a remote code execution flaw, meaning an attacker who can reach the exposed iSCSI target can potentially take control. The vulnerability also has fresh security patch activity and public attention, and given the “critical” severity, you should prioritize patching for any system that runs the iSCSI Target role.

What to do — in detail

Confirm exposure

On each Windows 10/Windows Server host, check whether the iSCSI Target Service / iSCSI Target role is installed and enabled.
Verify whether iSCSI target ports/endpoints are reachable from untrusted networks (for example, anything beyond your internal trusted management/storage network).

Check for vulnerable versions

Compare your OS build to the fixed versions Microsoft provides for CVE-2026-65791:

Windows 10: fixed in 10.0.14393.9418, 10.0.17763.9115, and 10.0.17763.9121 (depending on your branch/build)
Windows Server 2012: fixed in 6.2.9200.26280
Windows Server 2012 R2: fixed in 6.3.9600.23338
Windows Server 2016: fixed in 10.0.14393.9418
Windows Server 2019: fixed in 10.0.17763.9115 and 10.0.17763.9121
Windows Server 2022: fixed in 10.0.20348.5440 and 10.0.20348.5499
Windows Server 2025: fixed in 10.0.26100.33222 and 10.0.26100.33296

Apply the fix

Install the Microsoft security update for CVE-2026-65791 for your specific Windows version/branch.
Reboot if required by the update, then confirm the iSCSI Target Service is still functioning normally.

If patching must wait

Disable the iSCSI Target role/service on affected systems if it’s not required.
Restrict network access so iSCSI target endpoints are not reachable from untrusted networks (tight firewall rules and network segmentation).

What to monitor

After patching, monitor logs for repeated connection attempts to iSCSI target ports/services.
Watch Microsoft’s update guidance page for any follow-up notes to CVE-2026-65791: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65791.

Exploit/KEV notes

There is no entry in the CISA KEV list in the findings provided.
No public exploit code is on record in the findings provided, but the vulnerability has been patched and is receiving new attention.

Technical context

CVE-2026-65791 is an unauthorized remote code execution vulnerability (CWE-122) in the Windows iSCSI Target Service. The underlying issue is a heap-based buffer overflow that can be triggered via network access to the service, with the findings indicating an unauthenticated scenario (“PR:N/UI:N”). The traffic-light verdict is RED (treated as critical to address), and the patch exists with fixed versions listed for Windows 10 and multiple Windows Server releases. KEV is not listed in the provided findings, and no public exploit code is recorded, but press attention indicates new patch activity and association with the Lazarus group. EPSS is predicted low-to-moderate and flat in the findings provided, but that prediction is not what drives urgency here. KEV would indicate known exploitation; since it is not present in the provided findings, the current focus is rapid remediation of exposed systems rather than waiting for confirmed public exploit code.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS60th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.0% chance of exploitation activity in the next 30 days, which ranks it in the 60th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-14Patch availablerecord updated
2026-08-13OpenVAS check added
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 13 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable