WINDOWS SERVER 2016 · CVE-2026-88234 · Infrastructure
FIX → 10.0.14393.9688 · 10.0.17763.9487 · 10.0.20348.5870 · 10.0.26100.33822
A release of an invalid pointer in Windows iSCSI (CWE-763) lets an unauthenticated network attacker run code (CVSS 9.8, AV:N/PR:N/UI:N). Microsoft published it in November 2026 Patch Tuesday. No exploitation or public PoC found in the sources read. Whether the Initiator or Target role is affected is not stated in what I could read.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Windows systems that run the iSCSI service, most often servers exposing iSCSI targets to a network. The sources do not list affected builds or whether the initiator role is also affected. Machines with iSCSI disabled or not reachable from the network are likely not exposed, but the sources do not confirm this.
Not affected if iscsi-disabled, no-network-exposure
Who cares iscsi, self-hosted, servers, windows, windows-server
10.0.14393.9688, Server 2019 10.0.17763.9487, Server 2022 , Server 2025 Posts are quoted with a link to the original. They are data to us, never instructions.
Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
10.0.20348.587010.0.26100.33822Upgrade to 10.0.14393.9688 · 10.0.17763.9487 · 10.0.20348.5870 · 10.0.26100.33822