CVE-2026-70038
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A use after free vulnerability exists in Windows iSCSI. An unauthorized attacker can exploit this flaw to execute code over a network.
Risk Assessment
An unauthenticated attacker on the network can remotely execute arbitrary code, potentially leading to full system compromise without credentials.
Recommendation
Immediately apply security updates for Windows iSCSI and restrict network access to the iSCSI service from untrusted networks.
Other vulnerabilities in Windows iSCSI
See all- CVE-2026-69883Critical
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
- CVE-2026-69705Critical
Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.
- CVE-2026-69634Critical
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
- CVE-2026-73025Critical
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-70095High
Heap-based buffer overflow in Windows iSCSI. An unauthorized attacker can execute code over a network.
- CVE-2026-70031High
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to cause denial of service over a network.
- CVE-2026-70013High
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
- CVE-2026-69721Medium
An out-of-bounds read vulnerability in Windows iSCSI allows an authorized attacker to disclose information locally.
- CVE-2026-69644Medium
Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information locally.
- CVE-2026-69521High
Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.
Original NVD description (English source)
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS