PatchaPalooza

CVE-2026-65681: Windows iSCSI Target Service Denial of Service Vulnerability

CVE-2026-65681 is a denial of service vulnerability in Windows iSCSI Target Service, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.17% probability of exploitation activity in the next 30 days, higher than 68% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 6 security updates (KB5120238, KB5120242, KB5120229, KB5120233 and more). It affects 12 products in 1 product family (Windows).

Key facts

CVE ID
CVE-2026-65681
Severity
High CVSS 7.5
Microsoft severity
Important
Impact
Denial of Service
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-476
EPSS
1.17% (percentile 68%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
August 2026 Patch Tuesday
Product families
Windows

CVSS score and vector

Microsoft scores CVE-2026-65681 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
Confidentiality impactNone
Integrity impactNone
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network.

Affected products (12)

Windows

ProductSecurity updateTypeFixed buildRestart
Windows 10 Version 1809 for 32-bit SystemsKB5120238Security Update10.0.17763.9121Yes
Windows 10 Version 1809 for x64-based SystemsKB5120238Security Update10.0.17763.9121Yes
Windows Server 2019KB5120238Security Update10.0.17763.9121Yes
Windows Server 2019 (Server Core installation)KB5120238Security Update10.0.17763.9121Yes
Windows Server 2022KB5120242
KB5120229		Security Update
Security Hotpatch Update		10.0.20348.5499
10.0.20348.5440		Yes
Yes
Windows Server 2022 (Server Core installation)KB5120242
KB5120229		Security Update
Security Hotpatch Update		10.0.20348.5499
10.0.20348.5440		Yes
Yes
Windows Server 2025 (Server Core installation)KB5120233
KB5120228		Security Update
Security Hotpatch Update		10.0.26100.33296
10.0.26100.33222		Yes
Yes
Windows Server 2025KB5120233
KB5120228		Security Update
Security Hotpatch Update		10.0.26100.33296
10.0.26100.33222		Yes
Yes
Windows 10 Version 1607 for 32-bit SystemsKB5120418Security Update10.0.14393.9418Yes
Windows 10 Version 1607 for x64-based SystemsKB5120418Security Update10.0.14393.9418Yes
Windows Server 2016KB5120418Security Update10.0.14393.9418Yes
Windows Server 2016 (Server Core installation)KB5120418Security Update10.0.14393.9418Yes

Security updates (6)

NIST NVD data

NVD status
Analyzed
NVD CVSS
7.5 (HIGH)
NVD weakness
CWE-476
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
windows 10 1607 (x64)before 10.0.14393.9418
windows 10 1607 (x86)before 10.0.14393.9418
windows 10 1809 (x64)before 10.0.17763.9115
windows 10 1809 (x86)before 10.0.17763.9115
windows server 2016before 10.0.14393.9418
windows server 2019before 10.0.17763.9115
windows server 2022before 10.0.20348.5440
windows server 2025before 10.0.26100.33222

References

Acknowledgments

  • Linzishan & Anemone & Zhiniang Peng (HUST)

Revision history

VersionDateDescription
1.0Information published.

Sources