---
id: "CVE-2026-88234"
page: "https://infrastack.ai/live/CVE-2026-88234"
kind: "vulnerability"
aliases: ["CVE-2026-88234"]
title: "Windows iSCSI: invalid pointer release lets unauthenticated network attacker run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Server 2016", "fixed": ["10.0.14393.9688"], "affected": ">= 10.0.14393.0, < 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "Windows Server 2019", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": ">= 10.0.20348.0, < 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "iscsi", "self-hosted", "servers", "windows", "windows-server"]
not_affected_if: ["iscsi-disabled", "no-network-exposure"]
published_at: "2026-11-10T19:21:32+00:00"
first_seen_at: "2026-11-10T19:25:20+00:00"
updated_at: "2026-11-10T19:29:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88234", "first_seen_at": "2026-11-10T19:25:20+00:00"}, {"source": "analyst", "url": "https://www.strix.ai/cve/CVE-2026-88234", "first_seen_at": "2026-11-10T19:29:16+00:00", "cites": ["https://www.strix.ai/cve/CVE-2026-88234"]}]
exploit_sources: []
---

# Windows iSCSI: invalid pointer release lets unauthenticated network attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-88234 (this .md is for agents)

A release of an invalid pointer in Windows iSCSI (CWE-763) lets an unauthenticated network attacker run code (CVSS 9.8, AV:N/PR:N/UI:N). Microsoft published it in November 2026 Patch Tuesday. No exploitation or public PoC found in the sources read. Whether the Initiator or Target role is affected is not stated in what I could read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Server 2016 affected >= 10.0.14393.0, < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:Windows Server 2019 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487
- vendor:Windows Server 2022 affected >= 10.0.20348.0, < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run winver or [System.Environment]::OSVersion and compare the build with the fixed builds: Server 2016 10.0.14393.9688, Server 2019 10.0.17763.9487, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822. Check whether the iSCSI Target Server role is installed (Get-WindowsFeature FS-iSCSITarget-Server) and whether the MSiSCSI service is running (Get-Service MSiSCSI). Whether the Initiator role is affected is unconfirmed: confirm on Microsoft's page for CVE-2026-88234.

## Fix

Install the November 2026 Windows Server cumulative update that brings the build to at least the fixed version for your release (listed in how-to-check). The KB numbers are unconfirmed; get them from the MSRC page.

## Timeline

- 2026-11-10T19:25:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88234
- 2026-11-10T19:29:16+00:00 analyst https://www.strix.ai/cve/CVE-2026-88234 — Microsoft's MSRC page is JS-only and the CVRF API returned nothing readable, so nothing is verified. Affected builds come from CNA data mirrored by Strix (secondary). The initiator-role question is unanswered: the sources only say 'Windows iSCSI'.

## Documents

- [describes] CVE-2026-88234 (CNA data mirrored by Strix) https://www.strix.ai/cve/CVE-2026-88234

## From the sources

Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_