CVE-2026-69634 Critical iSCSI Buffer Overflow in Windows

Microsoft has disclosed a critical remote code execution vulnerability within the Windows iSCSI initiator service. The flaw allows unauthorized attackers to execute arbitrary code over a network by exploiting a heap-based buffer overflow.

What happened

Microsoft Security Update Guide lists CVE-2026-69634 as a vulnerability affecting the Windows iSCSI component. The advisory describes the issue as a heap-based buffer overflow that permits an unauthorized attacker to execute code remotely. The National Vulnerability Database records the same technical description for this CVE. The NVD assigns a CVSS score of 9.8 to the vulnerability, classifying its severity as Critical. The weakness is mapped to CWE-122, which covers heap-based buffer overflow errors. These errors occur when data is written beyond the boundaries of a memory buffer allocated on the heap.

Why it matters

Remote code execution flaws in network-facing services like iSCSI present significant risk to infrastructure. iSCSI is commonly used to connect servers to storage area networks over IP networks. If an attacker can exploit this buffer overflow, they could potentially take full control of the affected Windows system. The NVD rates the vulnerability as Critical. Systems that expose iSCSI services to untrusted networks are particularly vulnerable. The advisory notes that an unauthorized attacker can execute code over a network.

What to watch

• Monitor for unexpected outbound connections from servers running iSCSI initiators.
• Look for anomalous process creation or privilege escalation attempts on Windows hosts.
• Check for unusual memory allocation patterns or crashes in iSCSI-related services.
• Verify that only authorized systems can reach iSCSI target ports on your network.

Signals worth monitoring

Security teams usually review firewall logs for unauthorized access attempts to iSCSI ports. Check whether intrusion detection systems flag unusual payloads directed at Windows hosts. Look for signs of memory corruption or unexpected service restarts in system event logs. Monitor for new processes spawning from unexpected parent processes, which may indicate code execution. Verify that network segmentation rules are enforcing access controls between storage and compute tiers. Teams often correlate alerts from endpoint detection tools with network flow data to confirm compromise. Investigate any sudden increase in failed authentication attempts near iSCSI services.

Background: Network segmentation

Network segmentation divides a large network into smaller, isolated sub-networks. This restricts traffic flow based on strict rules, preventing attackers from moving freely between systems after an initial breach. It reduces the attack surface and contains potential damage by enforcing strict access controls between zones.

Read the full guide: Network Segmentation: Stop Lateral Movement Before It Starts

What to do and how to stay safe: Microsoft

• Restrict network access to iSCSI services using firewalls to only trusted IP ranges.
• Ensure Windows systems are updated with the latest security patches from Microsoft.
• Monitor system logs for signs of exploitation or unauthorized code execution.
• Implement network segmentation to isolate storage traffic from general network access.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-69634?

The National Vulnerability Database rates CVE-2026-69634 with a CVSS score of 9.8, which is classified as Critical.

What type of vulnerability is CVE-2026-69634?

It is a heap-based buffer overflow in the Windows iSCSI component that allows remote code execution.

Does the attacker need authentication to exploit this flaw?

The advisory states that an unauthorized attacker can execute code over a network.