Vulnerabilities
CVE-2026-70095: Windows iSCSI Target Service Remote Code Execution
A critical RCE flaw in the Windows iSCSI Target Service allows remote attackers to execute code via crafted iSCSI requests. The issue impacts Windows Server 2019 and 2022. Defenders should apply the latest cumulative update and restrict iSCSI traffic.
What happened
A remote code execution vulnerability (CVE‑2026‑70095) was discovered in the Windows iSCSI Target Service (iscsitargetsvc). The flaw allows an attacker to send a specially crafted iSCSI target request that causes the service to execute arbitrary code with SYSTEM privileges.
Impact
All Windows Server 2019 and Windows Server 2022 installations that have the iSCSI Target Service enabled are vulnerable. The vulnerability has a CVSS score of 9.8 and can be exploited over the network without authentication.
What to do
- Apply the latest cumulative update from Microsoft (KBxxxxxx) that patches the iSCSI Target Service.
- If the iSCSI Target Service is not required, disable the service or remove the feature via Server Manager.
- Block inbound iSCSI traffic (TCP port 3260) at the perimeter firewall unless it is explicitly needed.
- Verify the service is not running on vulnerable hosts by checking the service status or using PowerShell: Get-Service -Name iscsitargetsvc.
Monitoring and detection
Watch for anomalous iSCSI traffic or repeated connection attempts from unknown IPs. Use IDS/IPS signatures that flag suspicious iSCSI packets.
Related vulnerabilities
Windows iSCSI Use-After-Free Enables Remote Code Execution (CVE‑2026‑69883)
A use‑after‑free flaw in the Windows iSCSI target service permits an unauthenticated attacker to execute code remotely. All Windows systems running the iSCSI target are affected; applying the latest update and disabling the service if unused mitigates the risk.
Read briefing
OpenOffice Versions <4.1.17 Vulnerable to Remote Code Execution (CVE‑2026‑59265, CVE‑2026‑63277)
Multiple CVEs have been identified in OpenOffice versions older than 4.1.17 that enable remote code execution. The flaws allow an attacker to trigger arbitrary code on a target system via crafted documents. Defenders must apply the vendor’s patches immediately or upgrade to a supported release.
Read briefing
CVE‑2026‑62819: Remote Code Execution in Windows RRAS Service
Microsoft has identified a remote code execution flaw in the Routing and Remote Access Service (RRAS) that could allow attackers to execute arbitrary code on affected Windows Server systems. The vulnerability is present in Windows Server 2012 R2 through 2022 and requires immediate patching or service disablement.
Read briefing
CVE-2026-83748: Windows Error Reporting Remote Code Execution via Heap Overflow
A heap-based buffer overflow in Windows Error Reporting enables remote code execution by unauthenticated attackers. The flaw can be exploited over a network, allowing arbitrary code execution on affected systems. Apply the latest Microsoft security update or disable the Error Reporting service to mitigate the risk.
Read briefing