Vulnerabilities
Windows iSCSI Use-After-Free Enables Remote Code Execution (CVE‑2026‑69883)
A use‑after‑free flaw in the Windows iSCSI target service permits an unauthenticated attacker to execute code remotely. All Windows systems running the iSCSI target are affected; applying the latest update and disabling the service if unused mitigates the risk.
What happened
A use‑after‑free bug in the Windows iSCSI target service permits an unauthenticated attacker to execute code remotely. The flaw occurs when the service processes malformed iSCSI commands, leading to memory corruption that can be exploited to run arbitrary code.
Impact
All Windows systems that have the iSCSI target service enabled are vulnerable. An attacker who can reach the target over the network can gain local‑privilege execution on the host, potentially compromising the entire environment.
Mitigation
- Install the latest Microsoft security update that addresses CVE‑2026‑69883.
- Disable the iSCSI target service on machines that do not require it.
- Restrict inbound traffic to the iSCSI port (TCP 3260) using firewalls or VLAN segmentation.
- Monitor for anomalous iSCSI activity and failed authentication attempts in event logs.
Related vulnerabilities
CVE-2026-70014: Windows Cryptographic Services Remote Code Execution Exploit
Microsoft has identified a critical remote code execution flaw (CVE-2026-70014) in Windows Cryptographic Services that can be triggered by an authenticated attacker over the network. The use‑after‑free bug allows arbitrary code execution with service privileges on Windows 10, 11 and Server 2016‑2022. Apply the latest security update and restrict network access to mitigate the risk.
Read briefing
Microsoft Remote Desktop Client RCE via Use‑After‑Free (CVE‑2026‑108458)
A use‑after‑free flaw in Windows Remote Desktop Client allows an unauthenticated network attacker to execute arbitrary code. The vulnerability affects all versions of the client that ship with Windows 10/11 and Windows Server 2019/2022. Apply the latest Microsoft security update and enforce RDP restrictions immediately.
Read briefing
Windows Storage Use-After-Free Enables Local Privilege Escalation (CVE-2026-69763)
A use‑after‑free flaw in Windows Storage allows an authorized local user to elevate privileges. The vulnerability affects Windows 10, 11, Server 2019, and 2022. Defenders should apply the latest cumulative update and enforce least‑privilege policies.
Read briefing
CVE-2026-70026: Windows Secure Kernel Use‑After‑Free Enables Local Privilege Escalation
A use‑after‑free flaw in Windows Secure Kernel allows an authenticated local user to gain SYSTEM privileges. The vulnerability affects Windows 10, 11 and Server 2016‑2022. Microsoft has issued a patch; defenders should apply updates immediately and monitor for suspicious activity.
Read briefing