{"id":"CVE-2026-88234","kind":"vulnerability","aliases":["CVE-2026-88234"],"related":[],"title":"Windows iSCSI: invalid pointer release lets unauthenticated network attacker run code","description":"Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.","summary":"A release of an invalid pointer in Windows iSCSI (CWE-763) lets an unauthenticated network attacker run code (CVSS 9.8, AV:N/PR:N/UI:N). Microsoft published it in November 2026 Patch Tuesday. No exploitation or public PoC found in the sources read. Whether the Initiator or Target role is affected is not stated in what I could read.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","iscsi","self-hosted","servers","windows","windows-server"],"not_affected_if":["iscsi-disabled","no-network-exposure"],"how_to_check":"Run winver or [System.Environment]::OSVersion and compare the build with the fixed builds: Server 2016 10.0.14393.9688, Server 2019 10.0.17763.9487, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822. Check whether the iSCSI Target Server role is installed (Get-WindowsFeature FS-iSCSITarget-Server) and whether the MSiSCSI service is running (Get-Service MSiSCSI). Whether the Initiator role is affected is unconfirmed: confirm on Microsoft's page for CVE-2026-88234.","fix":"Install the November 2026 Windows Server cumulative update that brings the build to at least the fixed version for your release (listed in how-to-check). The KB numbers are unconfirmed; get them from the MSRC page.","status":"open","published_at":"2026-11-10T19:21:32+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","triaged_at":"2026-11-10T19:25:37+00:00","updated_at":"2026-11-10T19:29:16+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:25:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows iSCSI: invalid pointer release lets unauthenticated network attacker run code","impact":"high","summary":"A memory-handling flaw in the Windows iSCSI service lets an unauthenticated attacker on the network trigger a bad pointer release. The sources say this allows arbitrary code execution over the network.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","iscsi","servers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows host over the network","analyst_note":"Find Microsoft's advisory for CVE-2026-88234 to get affected Windows builds, the patch, and whether the initiator role is affected.","how_to_check":"- Check whether the iSCSI Initiator or Target service is enabled on Windows machines (unknown exact command in sources)\n- Confirm the installed Windows build against Microsoft's advisory for CVE-2026-88234 (unknown: sources do not give affected builds)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["iscsi-disabled","no-network-exposure"],"who_is_affected":"Windows systems that run the iSCSI service, most often servers exposing iSCSI targets to a network. The sources do not list affected builds or whether the initiator role is also affected. Machines with iSCSI disabled or not reachable from the network are likely not exposed, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00073,"input_tokens":4495,"output_tokens":560,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Microsoft's advisory for CVE-2026-88234 to get affected Windows builds, the patch, and whether the initiator role is affected.","search":"'-2026':13A,16A '-763':50B '-88234':14A,17A '2016':20A '2019':23A '2022':26A '2025':29A '2026':69B '9.8':59B 'affect':89B 'allow':107C 'attack':9A,55B,110C 'av':60B 'code':11A,57B,113C 'could':96B 'cve':12A,15A 'cvss':58B 'cwe':49B 'execut':112C 'exploit':73B 'found':77B 'host':34B 'infrastructur':30B 'initi':84B 'invalid':3A,44B,100C 'iscsi':2A,31B,48B,106C 'let':6A,51B 'microsoft':64B 'n':63B 'n/pr':61B 'n/ui':62B 'network':8A,54B,116C 'novemb':68B 'patch':70B 'poc':76B 'pointer':4A,45B,101C 'public':75B 'publish':65B 'read':81B,97B 'refer':103C 'releas':5A,41B,98C 'role':87B 'run':10A,56B 'self':33B 'self-host':32B 'server':19A,22A,25A,28A,35B,39B 'sourc':80B 'state':92B 'target':86B 'tuesday':71B 'unauthent':7A,53B 'unauthor':109C 'whether':82B 'window':1A,36B,38B,47B,105C 'windows':18A,21A,24A,27A 'windows-serv':37B","nicknames":[],"mitigations":[],"who_affected":"Windows systems that run the iSCSI service, most often servers exposing iSCSI targets to a network. The sources do not list affected builds or whether the initiator role is also affected. Machines with iSCSI disabled or not reachable from the network are likely not exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2016","server2019","server2022","server2025","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["2016","2019","2022","2025","server","windows"],"labels":["critical","infrastructure","iscsi","selfhosted","servers","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':13A,16A '-88234':14A,17A '2016':20A '2019':23A '2022':26A '2025':29A 'attack':9A 'code':11A 'cve':12A,15A 'invalid':3A 'iscsi':2A 'let':6A 'network':8A 'pointer':4A 'releas':5A 'run':10A 'server':19A,22A,25A,28A 'unauthent':7A 'window':1A 'windows':18A,21A,24A,27A","search_b":"'-763':50B '2026':69B '9.8':59B 'affect':89B 'attack':55B 'av':60B 'code':57B 'could':96B 'cvss':58B 'cwe':49B 'exploit':73B 'found':77B 'host':34B 'infrastructur':30B 'initi':84B 'invalid':44B 'iscsi':31B,48B 'let':51B 'microsoft':64B 'n':63B 'n/pr':61B 'n/ui':62B 'network':54B 'novemb':68B 'patch':70B 'poc':76B 'pointer':45B 'public':75B 'publish':65B 'read':81B,97B 'releas':41B 'role':87B 'run':56B 'self':33B 'self-host':32B 'server':35B,39B 'sourc':80B 'state':92B 'target':86B 'tuesday':71B 'unauthent':53B 'whether':82B 'window':36B,38B,47B 'windows-serv':37B","search_c":"'allow':107C 'attack':110C 'code':113C 'execut':112C 'invalid':100C 'iscsi':106C 'network':116C 'pointer':101C 'refer':103C 'releas':98C 'unauthor':109C 'window':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88234","severity":null,"published_at":"2026-11-10T19:21:32+00:00","modified_at":"2026-11-10T19:21:32+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","fetched_at":"2026-11-10T19:25:20+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88234:2511","url":"https://www.strix.ai/cve/CVE-2026-88234","severity":null,"published_at":"2026-11-10T19:29:16+00:00","modified_at":"2026-11-10T19:29:16+00:00","first_seen_at":"2026-11-10T19:29:16+00:00","fetched_at":"2026-11-10T19:29:16+00:00","note":"Microsoft's MSRC page is JS-only and the CVRF API returned nothing readable, so nothing is verified. Affected builds come from CNA data mirrored by Strix (secondary). The initiator-role question is unanswered: the sources only say 'Windows iSCSI'.","cites":["https://www.strix.ai/cve/CVE-2026-88234"]}],"documents":[{"id":117534,"url":"https://www.strix.ai/cve/CVE-2026-88234","title":"CVE-2026-88234 (CNA data mirrored by Strix)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}