---
id: "CVE-2026-105518"
page: "https://infrastack.ai/live/CVE-2026-105518"
kind: "vulnerability"
aliases: ["CVE-2026-105518"]
title: "Windows iSCSI: use-after-free lets an unauthorized network attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2019", "fixed": ["10.0.17763.9487"], "affected": "< 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows Server 2016", "fixed": ["10.0.14393.9688"], "affected": "< 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": "< 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": "< 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "iscsi", "rce", "self-hosted", "windows", "windows-server"]
not_affected_if: ["iscsi-unused", "patched"]
published_at: "2026-11-10T19:17:50+00:00"
first_seen_at: "2026-11-10T19:24:17+00:00"
updated_at: "2026-11-11T01:03:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105518", "first_seen_at": "2026-11-10T19:24:17+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105518", "first_seen_at": "2026-11-11T01:03:37+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-105518", "https://www.rapid7.com/blog/post/em-patch-tuesday-november-2026/"]}]
exploit_sources: []
---

# Windows iSCSI: use-after-free lets an unauthorized network attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-105518 (this .md is for agents)

Use-after-free in Windows iSCSI (CWE-416) fixed in the November 2026 Patch Tuesday. Microsoft rates it Important, CVSS 8.8 (AV:N/PR:N/UI:R): an unauthenticated network attacker can run code, but a user action is required. Rapid7 lists it as Exploitation Less Likely and not exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Server 2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822
- vendor:Windows Server 2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2019 affected < 10.0.17763.9487 fixed 10.0.17763.9487
- vendor:Windows Server 2016 affected < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:Windows 11 24H2 affected < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 11 25H2 affected < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:Windows 10 22H2 affected < 10.0.19045.7846 fixed 10.0.19045.7846

## How to check

Run winver or [System.Environment]::OSVersion in PowerShell and compare the full build (e.g. 10.0.26100.xxxx) with the fixed builds in the fix field. Lower means exposed. Also check whether the iSCSI Initiator service (MSiSCSI) is used or the iSCSI Target Server role is installed; whether either is required for exploitation is not stated in the sources.

## Fix

Install the November 2026 cumulative update. Fixed builds: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2/22H2 10.0.19044.7846/10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers: unknown, see the MSRC entry.

## Timeline

- 2026-11-10T19:24:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105518
- 2026-11-11T01:03:37+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-105518 — Microsoft MSRC page is JS-only and unreadable here; affected builds and fixed builds come from Microsoft's CNA record via NVD. KB numbers and whether iSCSI must be enabled are unknown. Rapid7: Exploitation Less Likely, not exploited.

## Documents

- [advisory] NVD: CVE-2026-105518 (CNA data from Microsoft) https://nvd.nist.gov/vuln/detail/CVE-2026-105518
- [describes] Rapid7 Patch Tuesday November 2026 https://www.rapid7.com/blog/post/em-patch-tuesday-november-2026/

## From the sources

Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_