CVE-2026-65796

This is a Windows “remote takeover” vulnerability in the iSCSI Target Service. If an attacker can reach that service over the network, they can trigger a memory error that lets them run their own code on your server—like getting a key to the building without needing a password.

This matters if you run Windows systems that include the Windows iSCSI Target Service (often used for storage connections) and the service is reachable from other networks. The risk is high specifically when the iSCSI Target Service is exposed over the network, because the attacker does not need authentication or a user to click anything. Only treat it as a risk if the iSCSI Target Service is reachable from the network you don’t fully control (for example, from untrusted networks).

This is RED urgency because exploitation has been reported in the wild and this vulnerability class can directly lead to full remote compromise. Even without public exploit code, attackers don’t need a login to trigger it once the iSCSI Target Service is exposed.