CVE-2026-65796

This is a Windows “remote takeover” vulnerability in the iSCSI Target Service. If an attacker can reach that service over the network, they can trigger a memory error that lets them run their own code on your server—like getting a key to the building without needing a password.

This matters if you run Windows systems that include the Windows iSCSI Target Service (often used for storage connections) and the service is reachable from other networks. The risk is high specifically when the iSCSI Target Service is exposed over the network, because the attacker does not need authentication or a user to click anything. Only treat it as a risk if the iSCSI Target Service is reachable from the network you don’t fully control (for example, from untrusted networks).

This is RED urgency because exploitation has been reported in the wild and this vulnerability class can directly lead to full remote compromise. Even without public exploit code, attackers don’t need a login to trigger it once the iSCSI Target Service is exposed.

1. Identify exposure

   • Confirm which machines run the Windows iSCSI Target Service (check role/features on the host and inventory against your iSCSI deployments).
   • Verify network reachability: ensure the iSCSI Target Service is not reachable from untrusted networks (the internet, guest networks, or any network segment outside your approved storage/control networks).
   • Look for firewall rules, load balancers, and port-forwarding that might expose the service.

2. Confirm patch level (per your Windows edition)

   • Windows 10: ensure you are on one of the fixed builds listed by Microsoft: 10.0.14393.9418 or 10.0.17763.9115 (or 10.0.17763.9121, depending on your branch).
   • Windows Server 2012: fixed in 6.2.9200.26280.
   • Windows Server 2012 R2: fixed in 6.3.9600.23338.
   • Windows Server 2016: fixed in 10.0.14393.9418 (or the matching branch equivalent).
   • Windows Server 2019: fixed in 10.0.17763.9115 (or 10.0.17763.9121, depending on your branch).
   • Windows Server 2022: fixed in 10.0.20348.5440 (or 10.0.20348.5499, depending on your branch).
   • Windows Server 2025: fixed in 10.0.26100.33222 (or 10.0.26100.33296, depending on your branch).

3. Apply the fix

   • Use Microsoft’s February/appropriate Patch Tuesday update process (or your managed patch system) to move each affected host to the fixed build above.
   • If multiple branches apply, follow your OS servicing channel to select the correct fixed build.

4. Temporary workaround if patching is delayed

   • Immediately reduce attack surface by blocking inbound access to the iSCSI Target Service from any untrusted networks.
   • Limit access to only the specific trusted storage/control networks and known initiators, using firewall and network segmentation.

5. After patching

   • Monitor for iSCSI Target Service errors/crashes and for unusual inbound connection attempts targeting the service.
   • If you have centralized logging (SIEM/event collection), search for repeated connection attempts or service instability around the timeframe of exposure.

Note on timelines

• CISA KEV does not list this issue.
• News reporting indicates Microsoft’s August 2026 Patch Tuesday included this flaw and that exploitation has been observed in the wild; prioritize patching quickly regardless of KEV listing.

Severity is high (CVSS 8.1) with remote network attack conditions and no authentication or user interaction required. The weakness is CWE-122: a heap-based buffer overflow in the Windows iSCSI Target Service. The reported mechanism is that an unauthenticated remote attacker can trigger the overflow over the network to execute arbitrary code.

Exploitation status: exploitation reported as YES in 2026-08-11 reporting tied to Microsoft’s August 2026 Patch Tuesday, where Microsoft-published fixes included “zero-days” and the WinSock driver bug was confirmed exploited; this reporting specifically references a related identified item in the text as CVE-2026-68820 as exploited in the wild, while the current CVE is the iSCSI Target Service remote code execution issue under discussion. No public exploit code is recorded.

KEV: not listed by CISA.

EPSS: a low predicted likelihood was reported (do not treat as a decision driver here since exploitation has been reported in the wild). Actor/attribution notes in the findings mention the Lazarus group in PULSE, and exploitation-related urgency is therefore treated as confirmed by the reported in-the-wild activity.