---
id: "CVE-2026-95898"
page: "https://infrastack.ai/live/CVE-2026-95898"
kind: "vulnerability"
aliases: ["CVE-2026-95898"]
title: "Windows iSCSI: heap buffer overflow lets a local user gain higher privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "iscsi", "local-privilege-escalation", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:21:43+00:00"
first_seen_at: "2026-11-10T19:25:23+00:00"
updated_at: "2026-11-10T20:27:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95898", "first_seen_at": "2026-11-10T19:25:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:27:42+00:00"}]
exploit_sources: []
---

# Windows iSCSI: heap buffer overflow lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-95898 (this .md is for agents)

A heap-based buffer overflow in the Windows iSCSI component lets an attacker who already has a local account raise their privileges. The sources give no further detail on the trigger or the affected Windows builds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:25:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95898
- 2026-11-10T20:27:42+00:00 analyst — Could not read the MSRC or NVD page (both returned empty through web-cli) and searches found no page for this CVE id. Affected builds, KB and whether the initiator or target service is involved are unknown. Settle by opening the Security Update Guide entry in a browser. Nothing verified, no documents linked, severity unchanged.

## From the sources

Heap-based buffer overflow in Windows iSCSI allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_