CVE-2026-70095: Windows iSCSI RCE Affects Windows 10, 11 and Server

Tracked by the Microsoft Security Response Center (MSRC) and documented in public CVE records reproduced by OpenCVE and Strix AI, the flaw stems from a heap-based buffer overflow that could allow an unauthorized attacker to execute code over a network. While the phrase "network-based remote code execution" naturally raises blood pressure in any Security Operations Center, a closer look at the official scoring vectors shows important nuances regarding attack complexity and user interaction that administrators should factor into their triage plans.

Breaking Down CVE-2026-70095: Severity and Scoring Nuances​

At the core of CVE-2026-70095 is CWE-122, a classic heap-based buffer overflow within Windows iSCSI. According to the CVE record published by Microsoft and indexed by OpenCVE and Strix AI, the vulnerability carries a CVSS 3.1 base score of 7.5 (High).

To understand why a network-based remote code execution bug lands at a 7.5 rather than a 9.8, it helps to examine the full CVSS vector string assigned to the advisory: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

• Attack Vector (AV:N): Network. The vulnerable component is bound to the network stack, meaning an attack can be delivered over a network connection.
• Attack Complexity (AC:H): High. Successful exploitation depends on conditions beyond the attacker's immediate control.
• Privileges Required (PR:N): None. The attacker does not need valid credentials beforehand; the advisory describes the threat actor as an unauthorized attacker.
• User Interaction (UI:R): Required. Unlike a pure "zero-click" wormable flaw, the vector specifies that some form of user action is necessary for exploitation to succeed.
• Scope (S:U) and Impact (C:H/I:H/A:H): Unchanged scope, with High potential impact across Confidentiality, Integrity, and Availability.

Alongside Microsoft's CVSS assessment, the Cybersecurity and Infrastructure Security Agency (CISA) Authorized Data Publisher (ADP) Vulnrichment program appended Stakeholder-Specific Vulnerability Categorization (SSVC v2.0.3) metrics to the record. As of the October 13–14, 2026 updates recorded in OpenCVE, CISA lists Exploitation as none, Automatable as no, and Technical Impact as total. Meanwhile, the National Vulnerability Database (NVD) entry, which mirrors Microsoft's CNA data, remained in "Awaiting Analysis" status immediately following disclosure.

In short, what do these numbers mean for your environment? The potential payoff for an attacker is complete compromise of the affected component's confidentiality, integrity, and availability, which is why CISA rates the technical impact as total. However, the combination of high attack complexity, required user interaction, and no recorded active exploitation means this is a structured patching priority rather than a drop-everything zero-day emergency. Microsoft's public CVE summary does not disclose the exact code path, the specific iSCSI initiator or target configuration involved, or what user interaction is required to trigger the overflow.

Section Summary: CVE-2026-70095 is a CWE-122 heap-based buffer overflow in Windows iSCSI rated 7.5 (High). While it permits network-based code execution without prior privileges, the CVSS vector indicates both high attack complexity and required user interaction, and CISA reports no known active exploitation.

Affected Windows Client and Server Versions​

One of the most striking aspects of CVE-2026-70095 is the sheer breadth of the affected product matrix. Because iSCSI support is baked across Microsoft's client and server operating systems, the vulnerability touches legacy Long-Term Servicing builds, modern Windows 11 feature updates, and data center staples from Windows Server 2012 all the way to Windows Server 2025.

According to the Microsoft CNA data captured in the CVE record on OpenCVE, systems running builds earlier than the fixed version thresholds listed below are affected:

A Critical Note for Vulnerability Scanners and Patch Managers​

If you write custom compliance queries or manage automated vulnerability scanners that ingest raw CVE JSON or CPE metadata, look closely at the Windows 10 Version 22H2 entry in the table above.

In the published CVE record, Microsoft's metadata lists the starting build for Windows 10 Version 22H2 as 10.0.19045.0, which is standard for 22H2. However, the lessThan (fixed build) boundary attached to that exact entry is 10.0.19044.7807—a 19044 build number shared with Windows 10 21H2. Because 10.0.19045.0 is numerically greater than 10.0.19044.7807, a naive version-comparison script evaluating 19045.x < 19044.7807 could falsely conclude that unpatched Windows 10 22H2 machines are unaffected, or fail to match the range properly.

Administrators managing Windows 10 22H2 fleets should verify the exact KB package and build revision (7807) directly against the MSRC Security Update Guide rather than relying blindly on automated CPE range matching for that specific branch.

Section Summary: The vulnerability spans supported client and server editions from Windows Server 2012 through Windows Server 2025 and Windows 11 26H2, including Server Core installations. Admins should watch out for a metadata quirk in the CVE record for Windows 10 22H2 where a 19045.0 starting build is paired with a 19044.7807 fixed threshold.

Practical Guidance for Windows Administrators​

When a storage protocol vulnerability drops during Patch Tuesday, the temptation in some quarters is to immediately start ripping out services or writing emergency firewall blocks. However, disciplined change management requires sticking to what the evidence actually supports.

Because the public CVE record does not specify whether the heap-based buffer overflow resides in the iSCSI Initiator service, an iSCSI Target component, or a shared driver library—nor does it document any official workarounds—administrators should avoid speculative service disabling that could sever storage Area Network (SAN) volumes or cluster shared volumes in production. Instead, follow a structured verification workflow:

1. Audit OS Build Revisions Across Client and Server Estates: Compare your deployed endpoints and servers against the fixed build numbers listed in the CVE record. Remember that Server Core installations for Windows Server 2012, 2012 R2, 2016, 2019, and 2025 are explicitly included in the affected product list.
2. Cross-Check Windows 10 22H2 Reporting: If your vulnerability management platform ingests NVD or CVE 5.0 JSON feeds directly, check how it evaluates Windows 10 22H2 machines for CVE-2026-70095. Ensure those systems receive the October 2026 cumulative update bringing them to the .7807 revision level.
3. Prioritize Systems Where Storage and User Activity Intersect: While all affected builds should receive the security update through normal patch rings, servers and administrative workstations that combine network exposure with interactive user sessions warrant timely deployment given the AV:N and UI:R characteristics of the vulnerability.
4. Confirm Package Details via MSRC: Before pushing updates to sensitive storage nodes or failover clusters, consult the official MSRC Security Update Guide entry for CVE-2026-70095 to match the exact Knowledge Base (KB) package for your servicing channel and coordinate appropriate maintenance windows.

By focusing on accurate build verification and standard cumulative update deployment, IT teams can neutralize CVE-2026-70095 cleanly without risking storage downtime.