{"id":"CVE-2026-122177","kind":"vulnerability","aliases":["CVE-2026-122177"],"related":[],"title":"Windows iSCSI: link following lets a network attacker elevate privileges (fixed in November 2026 updates)","description":"Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to elevate privileges over a network.","summary":"Windows iSCSI resolves a symbolic or file link before accessing a file, so an attacker can redirect that access. The sources say an unauthorized attacker over the network can elevate privileges.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows iSCSI","fixed":["10.0.14393.9688","10.0.17763.9487","10.0.19044.7846","10.0.19045.7846","10.0.22631.7711","10.0.26100.9974","10.0.26200.9974","10.0.28000.3501","10.0.26300.9974","10.0.20348.5870","10.0.26100.33822"],"affected":"Windows 10 1607/Server 2016 < 10.0.14393.9688; 1809/Server 2019 < 10.0.17763.9487; 10 21H2 < 10.0.19044.7846; 10 22H2 < 10.0.19045.7846; 11 23H2 < 10.0.22631.7711; 11 24H2 < 10.0.26100.9974; 11 25H2 < 10.0.26200.9974; 11 26H1 < 10.0.28000.3501; 11 26H2 < 10.0.26300.9974; Server 2022 < 10.0.20348.5870; Server 2025 < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","iscsi","self-hosted","windows"],"not_affected_if":["iscsi-not-used"],"how_to_check":"- Run (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').CurrentBuild plus UBR, or winver, and compare with the fixed builds in the fix field.\n- Check whether iSCSI is in use: Get-Service MSiSCSI (initiator) and Get-WindowsFeature FS-iSCSITarget-Server (Target role on Server). Whether the service is on by default is not stated in the sources I could read; confirm on the MSRC page.","fix":"Install the November 2026 Windows cumulative update that raises the build to at least: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers not read. Build numbers come from a mirror of Microsoft's CVE record, not the MSRC page.","status":"open","published_at":"2026-11-10T19:20:35+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","triaged_at":"2026-11-10T19:44:18+00:00","updated_at":"2026-11-10T21:38:52+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:44:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows iSCSI: link following lets a network attacker gain higher privileges","impact":"high","summary":"Windows iSCSI resolves a symbolic or file link before accessing a file, so an attacker can redirect that access. The sources say an unauthorized attacker over the network can elevate privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","iscsi","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker over the network raises privileges on the Windows host","analyst_note":"Confirm the affected Windows builds, the fixed update and whether the iSCSI service is on by default, from Microsoft's CVE-2026-122177 advisory.","how_to_check":"- Check whether the iSCSI Target or Initiator service is running on the Windows machine, for example with `Get-Service MSiSCSI` in PowerShell.\n- Confirm the Windows build against Microsoft's security update guide for CVE-2026-122177.","plain_action":"","product_name":"Windows iSCSI","needs_analyst":true,"not_affected_if":["iscsi-not-used"],"who_is_affected":"Windows machines that run the iSCSI service are the systems to look at, because the flaw is in how that service handles file links over the network. unknown whether the sources name a default setting that makes it reachable or a configuration that avoids it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4498,"output_tokens":556,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected Windows builds, the fixed update and whether the iSCSI service is on by default, from Microsoft's CVE-2026-122177 advisory.","search":"'-122177':18A,21A '-2026':17A,20A '2026':14A 'access':39B,48B,66C 'allow':72C 'attack':8A,44B,54B,75C 'cve':16A,19A 'elev':9A,59B,77C 'file':36B,41B,65C 'fix':11A 'follow':4A,68C 'host':28B 'improp':61C 'infrastructur':24B 'iscsi':2A,23A,25B,31B,71C 'let':5A 'link':3A,37B,62C,67C 'network':7A,57B,81C 'novemb':13A 'privileg':10A,60B,78C 'redirect':46B 'resolut':63C 'resolv':32B 'say':51B 'self':27B 'self-host':26B 'sourc':50B 'symbol':34B 'unauthor':53B,74C 'updat':15A 'window':1A,29B,30B,70C 'windows':22A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016 to 2025 builds below the November 2026 fixed builds are listed as affected in Microsoft's CVE record. Systems that use iSCSI (storage servers with the iSCSI Target role, hosts with the iSCSI Initiator connected to storage) are the ones to look at. Machines that do not use iSCSI are likely lower risk, but the sources do not say whether the service is on by default. The CVSS vector rates attack complexity high and needs user interaction.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["iscsi","windowsiscsi"],"ptokens":["iscsi","windows"],"labels":["high","infrastructure","iscsi","selfhosted","vendor","windows"],"campaign_type":null,"search_a":"'-122177':18A,21A '-2026':17A,20A '2026':14A 'attack':8A 'cve':16A,19A 'elev':9A 'fix':11A 'follow':4A 'iscsi':2A,23A 'let':5A 'link':3A 'network':7A 'novemb':13A 'privileg':10A 'updat':15A 'window':1A 'windows':22A","search_b":"'access':39B,48B 'attack':44B,54B 'elev':59B 'file':36B,41B 'host':28B 'infrastructur':24B 'iscsi':25B,31B 'link':37B 'network':57B 'privileg':60B 'redirect':46B 'resolv':32B 'say':51B 'self':27B 'self-host':26B 'sourc':50B 'symbol':34B 'unauthor':53B 'window':29B,30B","search_c":"'access':66C 'allow':72C 'attack':75C 'elev':77C 'file':65C 'follow':68C 'improp':61C 'iscsi':71C 'link':62C,67C 'network':81C 'privileg':78C 'resolut':63C 'unauthor':74C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122177","severity":null,"published_at":"2026-11-10T19:20:35+00:00","modified_at":"2026-11-10T19:20:35+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","fetched_at":"2026-11-10T19:25:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122177:2830","url":"https://app.opencve.io/cve/CVE-2026-122177","severity":null,"published_at":"2026-11-10T21:38:52+00:00","modified_at":"2026-11-10T21:38:52+00:00","first_seen_at":"2026-11-10T21:38:52+00:00","fetched_at":"2026-11-10T21:38:52+00:00","note":"MSRC page unreadable (JS only); versions from OpenCVE mirror of Microsoft CNA record. Nothing verified. No exploitation or PoC seen. Need MSRC page for KBs and iSCSI default state.","cites":["https://app.opencve.io/cve/CVE-2026-122177"]}],"documents":[{"id":118969,"url":"https://app.opencve.io/cve/CVE-2026-122177","title":"OpenCVE: CVE-2026-122177 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}